EU extends mass scanning of private messages to 2028 after a majority of lawmakers voted to kill it

EU Chat Control outlives the majority that voted to kill it

314 members of the European Parliament voted to scrap the mass scanning of private messages on July 9. 276 voted to keep it. The scanning regime survived anyway. 1

That arithmetic is the story. The Parliament has 720 seats. Under the EU's ordinary legislative procedure, blocking the Council of the European Union at second reading requires an absolute majority of 361 votes, regardless of how many MEPs cast a ballot. On July 9, 314 voted to reject the Council's position, 276 voted against rejection, and 17 abstained. The bid to kill the rule fell 47 votes short. 2 More lawmakers tried to end mass chat scanning than defend it. The rule survived because the procedure did not ask whether a majority of voting MEPs were opposed. It asked whether 361 of them were.

The rule is Chat Control: a temporary exemption from the EU's ePrivacy Directive that lets online communications platforms voluntarily scan user messages for child sexual abuse material (CSAM), flag matches, and remove them. Participation is optional. Companies may scan, not must. 1

The framework took effect in August 2021 as a stopgap, built on the assumption that a permanent CSAM regulation would follow within months. Five years and five rounds of trilogue negotiations later, that permanent law still has not passed. 2 The stopgap itself lapsed on April 3, 2026, opening a three-month window in which voluntary scanning under this legal basis was not permitted in the EU at all. 2

The Council moved to revive it. On July 2, 2026, the Council of the European Union adopted its position at first reading, restoring the European Commission's original, broader proposal. 2 The European People's Party then invoked an urgency procedure on July 7 to force a second-reading plenary vote before the summer recess, skipping committee review. 2 Four European Commissioners, Henna Virkkunen, Magnus Brunner, Michael McGrath, and Glenn Micallef, wrote to lawmakers the day before urging acceptance. 3

MEPs had already rejected the extension twice in prior months. 3 Former Pirate Party MEP Patrick Breyer said it was unprecedented for the Parliament's president to reopen legislation that lawmakers had already voted down, and called the outcome a "farce" that damages democracy. 3 1

Parliament did extract one change. By votes of 369 and 362, MEPs excluded end-to-end encrypted communications from the scanning provisions, clearing the same 361-vote threshold that rejection missed. 2 The practical impact may be limited: providers of encrypted services cannot inspect message contents in transit regardless of what the regulation says. 1

The amended text now returns to the Council, which has three months, roughly until October 9, to accept or reject the changes. 2 Acceptance extends the derogation until April 3, 2028. Rejection of any amendment triggers a conciliation committee and months more negotiation. 1

The permanent replacement remains stalled. The Child Sexual Abuse Regulation, designed to supersede the stopgap, has been through five rounds of trilogue, including what was supposed to be the final round on June 29, with no resolution on its core dispute: whether mandatory scanning and end-to-end encryption can coexist. 1 The next trilogue is set for September. 3

The scanning is voluntary. No platform is required to participate. Platforms scanned under a derogation that more elected lawmakers tried to destroy than defend, and they will scan under whatever version survives the Council's review.

The platforms are not bystanders in a policy dispute. They are voluntary participants in a framework that Europe's parliament tried to stop and structurally could not. 314 MEPs voted no. 276 voted yes. The framework survives because the companies choose to participate, and the procedure built to halt it requires a supermajority that fell 47 votes short.