BRUSSELS — The European Union just prolonged a temporary framework that lets tech giants scan private messages for child sexual abuse material. Critics call it a backdoor to mass monitoring. And the numbers don’t lie. On July 10, 2026, the European Parliament voted 314 against and 276 in favor. The motion to reject the Council’s position fell short of the 361 votes needed. So the extension passed.
Under the rules, companies such as Meta, Google and Microsoft can voluntarily scan emails, messages and other online communications from users in the bloc. The measure, known as Chat Control 1.0 to its opponents, runs until April 2028 once the Council of the EU signs off. It spares end-to-end encrypted services like WhatsApp and Signal. For now.
But the vote exposed deep rifts. Supporters from the center-right EPP group warned against any gap in child protection during the summer recess. “We cannot go to the summer recess knowing that our children are not protected,” said Tomas Tobé, a Swedish MEP. Manfred Weber, the EPP leader, posted on X: “We must extend the law on child sexual abuse material detection online. Protect children, not predators.”
Opponents saw something else. A procedural trick. An erosion of privacy. “That’s not democracy. That’s a trick,” Luxembourg MEP Sven Clement wrote on X. German Green MEP Patrick Breyer labeled the outcome “a farce” that damages trust in EU institutions. Children, he added, “are the real losers in this undemocratic process.” The Council, Breyer argued, will avoid real reform as long as voluntary scanning by private firms remains an option.
Parliament’s Limited Power
The European Conservative detailed how the Commission first pushed the original proposal in 2022. It sought mandatory client-side scanning across all platforms. Parliament pushed back hard in 2024, rejecting the plan with 318 votes against, 65 in favor and 50 abstentions. Yet the executive branch found a workaround. It extended the existing ePrivacy derogation administratively. Parliament stood sidelined. “This is democracy in action: the EU Parliament has been sidelined once again,” the publication observed in its February 2025 commentary.
That pattern repeated this month. The urgent procedure limited debate. Many MEPs had already left for summer break. The threshold for an absolute majority to block the Council position proved too high. So a minority position carried the day. Privacy advocates cried foul. Digital rights group EDRi warned that the setup hands extraordinary power to American platforms. “It will mean that private companies may deny your right to have confidential digital conversations,” Simeon de Brouwer told WIRED, as cited by Newsweek. “They could, if they want to, read every message you write, every email you send, every picture you share.”
MEP Svenja Hahn of Germany’s FDP captured the fear in stark terms. The rules, she said, open “the door for mass surveillance of all private communication of our European citizens instead of the targeted fight against child sexual abuse.” Her words echoed across social media. On X, users from privacy-focused accounts like @TutaPrivacy and @nym highlighted how the system outsources law enforcement to U.S. tech firms. Messages get scanned on their servers. Then forwarded to European authorities. Digital sovereignty, critics scoffed, looks hollow.
Recent coverage adds fresh context. A July 10 report from Crypto.news notes the revival of the temporary framework while stressing the encryption carve-out. Yet the piece also flags ongoing talks that could shape a permanent regime. Ground News aggregated coverage showing the 314-276 tally and the two-year extension, underscoring how procedural rules let the measure advance despite majority opposition in the vote.
The original push dates back years. The European Commission first proposed broad scanning in 2022 to combat CSAM. Lawmakers, tech executives and civil society groups raised alarms about false positives, weakened encryption and mission creep. By late 2023, Parliament had softened the text, demanding targeted approaches over blanket surveillance. The Council dragged its feet. When the temporary rules expired in 2025, the Commission simply revived them. First through administrative extension. Then through this parliamentary vote.
Industry reactions remain muted in public. No major platform issued detailed statements immediately after the July vote. But the implications loom. Providers must decide whether to opt in. Those that do face technical challenges and legal risks. Those that don’t risk appearing soft on child protection. The voluntary nature creates uneven enforcement across the bloc. And it leaves ordinary users in the dark about whether their messages travel through scanning systems.
Advocates point to alternatives. Better funding for law enforcement. Improved international cooperation. Investment in targeted detection that respects encryption. Breyer and others argue the current path distracts from genuine solutions while normalizing bulk interception. “The EU built its surveillance infrastructure on American servers,” one X post from @nym observed. Then it passed laws claiming digital sovereignty. The contradiction stings.
Non-EU citizens aren’t immune. Anyone using an EU-facing service while physically in the bloc could see their communications scanned. Tourists. Business travelers. Expatriates. The rules regulate providers, not individual users. Yet the net spreads wide.
Looking ahead, the Council has three months to formalize the extension. Approval appears likely. Meanwhile, work continues on a more permanent framework. The Commission has signaled plans for new legislation that could incorporate AI analysis and age verification tools. Whether those ideas survive negotiations remains uncertain. Past rounds showed fierce resistance from encryption advocates and smaller member states.
For now, the July decision buys time. Two more years of voluntary scanning. Two more years of debate. But the core tension persists. How does a democratic union balance child safety against the right to private conversation? The answer so far favors expediency over principle. Parliament tried to stop it. Procedures wouldn’t let them. The extension passed anyway. Short. Sharp. And telling.
WebProNews is an iEntry Publication