Chat Control: what the vote provides for and what changes technically

Updated 10 July 2026

What was voted on on 9 July 2026

The binding vote of 9 July ended with 314 votes against the blocking motion, 276 in favour and 17 abstentions: although the majority of those voting were against the text, the motion did not reach the absolute majority of 361 votes needed to stop it, and the derogation therefore passed. At the same time, a symbolic exemption was approved for end-to-end encrypted communications, which in practice providers were not scanning anyway. On the other hand, for the same procedural reason, an amendment that would have limited scanning to suspects identified by the judiciary fell, despite having gathered 322 votes in favour and 255 against.

This derogation had already expired on 3 April 2026, after Parliament rejected it by a single vote (307 to 306) on 25-26 March 2026. The relaunch was led by the EPP with the decisive support of S&D and Renew, following an appeal by four European Commissioners who warned of a regulatory gap for investigative authorities after the derogation expired.

This is not yet the full "Chat Control" proposal (also known as CSAR), which provides for more invasive scanning obligations: that remains a separate dossier, still under negotiation between Parliament and the Council of the EU, with the fifth and final round of trilogue ending on 29 June 2026 without a final agreement.

Scenario 1: From 10/07/2026 with the ePrivacy derogation (currently in force)

In this case the technical impact is relatively limited:

• On the server side: providers (Gmail, Meta, Microsoft) can run *hashing algorithms that compare uploaded content with databases of already known illegal material.
• On the client side: no change to the user's device. Scanning happens only after the content reaches the provider's servers, so it does not affect apps with **end-to-end encryption (E2E) such as Signal or WhatsApp.
• Reversibility: since it is voluntary, each provider can decide not to enable it or to disable it in the future.
• Duration: the version approved by the Council of EU countries introduces no substantial changes and would allow providers to detect, report and remove child sexual abuse material until 2028.

Scenario 2: if the full CSAR were to pass in the future

Here the technical details would change radically, because the regulation does not specify where scanning must take place, but requires the order to be enforceable — which in practice shifts the check onto the device when services are end-to-end encrypted.

• ***Client-side scanning: an algorithm runs locally on the device (smartphone, PC) and analyses text, images and video before encryption, that is, before the message is protected and sent.
• Moment of interception: the check happens during upload, while the content is still "in the clear" (****plaintext) in the device's memory, thus bypassing the protection of end-to-end encryption.
• Matching mechanism: *****perceptual hashing techniques or machine learning models trained to recognise known patterns of illegal material are used, compared against hash lists managed by a European coordination centre (EU Centre).
• ******Detection order: it is not a permanent switch, but must be issued by an independent judicial or administrative authority for a specific platform, with verified risk and time limits.
• Structural risk: introducing client-side scanning requires inserting into the client's code a module that accesses content before encryption — in effect an additional attack surface, potentially exploitable by malicious actors too and not only by the authorities.
• Effect on E2E apps: apps like Signal would have to integrate the scanning agent into their own client software, or — according to the company's public statements — they could withdraw from the EU market rather than compromise their security architecture.

What would not change in either scenario

The encryption protocol itself (for example the Signal Protocol) would not be altered: the problem concerns access to the plaintext content on the client side before it is encrypted. Communications already encrypted in transit on the servers would remain unreadable to providers.

Why many experts consider this approach wrong

Numerous digital rights activists, data protection authorities and even the European Court of Human Rights have harshly criticised the approach of the proposal. The main problem, according to these critics, is that the system reverses the logic of the presumption of innocence: it turns generalised monitoring into the rule and privacy becomes the exception, instead of the other way round.

• The European Court of Human Rights already ruled, in a judgment of February 2024, that weakening end-to-end encryption is incompatible with Article 8 of the Convention, the one that protects private life and correspondence.
• Ethereum co-founder Vitalik Buterin publicly stated that "you cannot make society secure by making people insecure", stressing that backdoors created for law enforcement are "inevitably hackable".
• Several European data protection authorities have flagged the concrete risk of generalised and indiscriminate *******mass surveillance, without adequate limits or safeguards for ordinary citizens.
• Digital rights associations stress that every private message, photo or video shared on apps like WhatsApp, Telegram or Signal could end up being analysed by automated algorithms, even in the absence of any concrete suspicion about the user.
• According to Fight Chat Control's monitoring, the extension threatens the rights guaranteed by Articles 7 and 8 of the EU Charter of Fundamental Rights, exposing people to false positives (holiday pictures or private jokes wrongly classified as illegal) and creating a global precedent that could be invoked by authoritarian governments to justify invasive surveillance.

The concrete technical risks: data breaches and misuse of data

Beyond the ethical question, cybersecurity experts point to very practical technical problems linked to building this kind of control infrastructure.

• Every ********backdoor created for legitimate purposes is an entry point which, once it exists in the code, can be discovered and exploited by hackers, hostile governments or criminal organisations too, not only by the competent authorities.
• Giving a centralised body privileged access to the content of chats carries serious risks, given the well-established history of *********data breaches suffered even by government bodies and big tech companies.
• A real case often cited as an example is the Ambrosetti data breach, which involved 61,000 people because of passwords stored in plain text, showing how easily data collection systems can be compromised.
• In the event of a breach, the fines of the Italian Data Protection Authority can reach 10 million euros or 2% of the annual worldwide turnover of the company involved, but the reputational and personal damage for citizens remains irreversible all the same.
• Once collected on a large scale, the analysed content (text, images, metadata) could in theory be used to train **********artificial intelligence models, enormously increasing the amount of sensitive personal data processed outside the user's explicit consent.
• Creating permanent vulnerabilities in software, at a time of increasingly sophisticated cyber attacks, can turn into an enormous collective risk for the entire European digital ecosystem, and not only for the individual users involved.
• Child protection experts, including UN organisations, also warn that mass surveillance does not effectively prevent abuse and risks making children less safe, diverting resources from already proven protective measures.

Beyond the technical reasons - a concrete risk for the future

If, technically speaking, this is a usurpation of E2E protocols, a dangerous precedent is also being created. At this moment it is fairly clear that, despite the votes against, in Europe there is a will to push this kind of law through by any means. If the "2.0" law is still stalled, the same cannot be said of its "1.0" version, which, just to get it approved, was put to a vote on the last day before the holidays (and we all know politicians have no sense of duty until the last day) and above all with an absolute majority required for the final rejection, which obviously was not reached. In my opinion this kind of law creates a very serious precedent in European history: if the law really were to pass in its "2.0" form, the only ways to have private correspondence would become non-mainstream apps that nobody knows, some of them technically difficult to set up. Not to mention that if the check is done on the app side, you will need an app built ad hoc (as in the case of Element for Matrix).

The cultural problem

"I have nothing to hide, and it's a good thing if they catch the bad guys." Most people answer like this when I raise the problem with them. In most cases the person I'm talking to understands neither the technical nor the political aspects behind such a decision (essentially they can't see past the end of their own nose). That's why I created www.michelepelosi.com, to share this kind of information with "ordinary" people... but you need at least the will to read it T_T

p.s. this was just a little personal rant, don't mind it.

---

Timeline of the Chat Control dossier

• 11 May 2022 — The European Commission presents the original proposal, which would require all email and messaging providers to scan communications for child sexual abuse material.
• 1 July 2025 — Denmark takes over the presidency of the Council of the EU and relaunches Chat Control as a legislative priority, aiming for adoption by 14 October 2025.
• August-October 2025 — Opposition follows from the Czech Republic, Finland, Germany, Luxembourg, Slovakia and Estonia, while Belgium, Latvia and Italy remain undecided.
• 7 October 2025 — Germany (CDU/CSU) publicly declares its opposition to indiscriminate monitoring of chats.
• 30 October - 12 November 2025 — The Danish presidency circulates an updated proposal; analyses emerge denouncing the reintroduction of scanning of end-to-end encrypted content too, through Articles 4 and 6.
• 15 November 2025 — The text is revised to explicitly exclude the scanning obligation (recital 17a), while keeping incentives for voluntary scanning.
• 26 November 2025 — The Council approves the revised Danish proposal; only the Czech Republic, Italy, the Netherlands and Poland abstain from approval.
• 18 December 2025 — The Commission proposes extending the Chat Control 1.0 derogation by another two years, moving the deadline from April 2026 to April 2028.
• 1 January 2026 — Cyprus takes over the rotating presidency of the Council of the EU, continuing the trilogue negotiations.
• 5 February 2026 — Rapporteur Birgit Sippel (S&D) presents her draft report, proposing the extension of the derogation while excluding the technologies considered most unreliable (text scanning and automated assessment of unknown images).
• 2 March 2026 — The LIBE Committee rejects the Sippel report with 38 votes against, 28 in favour and 3 abstentions, temporarily blocking the second extension.
• 10-11 March 2026 — Parliament votes to stop indiscriminate mass scanning, rejecting the unconstitutional surveillance practices of recent years; in the same session a last-minute compromise by S&D, EPP and Renew proposes introducing AI to scan unknown texts and images.
• 16 March 2026 — The second trilogue on Chat Control 1.0 ends without results; the temporary ePrivacy derogation is still set to expire on 4 April.
• 19 March 2026 — Rapporteur Sippel endorses untargeted mass scanning for already known material, even though Parliament had adopted amendment 5, which required scanning to be limited to suspected users with judicial authorisation.
• 22-25 March 2026 — The EPP forces a repeat vote for Thursday 26 March, trying to overturn Parliament's decision of principle; the Greens/EFA attempt to remove the vote from the agenda fails.
• 26 March 2026 — Amendment 34 (which rejects the automated assessment of unknown photos and texts) passes by a single vote, leading to the almost complete rejection of the Chat Control 1.0 extension; the derogation finally expires on 3 April.
• 16 April 2026 — The third round of trilogue on the Chat Control 2.0 proposal takes place.
• 11 May 2026 — Fourth round of trilogue; negotiations continue without a final agreement.
• 29 June 2026 — Fifth and final round of trilogue on Chat Control 2.0, also without a conclusive result.
• 30 June 2026 — With negotiators still deadlocked, the Council and the EPP try to bypass Parliament by reviving the expired Chat Control 1.0 derogation with an identical text, thus bypassing the Commission's right of initiative and a new opinion from the European Data Protection Supervisor.
• 7 July 2026 — Parliament votes 331-304 (11 abstentions) to fast-track the return of the Chat Control 1.0 derogation with the urgent procedure.
• The binding vote of 9 July ended with 314 votes against the blocking motion, 276 in favour and 17 abstentions, so the derogation passed: From today, therefore, chats such as Gmail, Instagram, Discord or iCloud can once again be voluntarily scanned by providers without suspicion or judicial authorisation, until 2028; End2End Encrypted chats remain intrinsically/judicially excluded.

---

Glossary of technical terms

• *Hashing: a technique that turns a file into a unique string of characters (a digital fingerprint), used to compare content without having to read it directly.
• **End-to-end encryption (E2E): a system in which only the sender and the recipient can read the message, because encryption happens on the device and the message never passes through the server in the clear.
• ***Client-side scanning: analysis of content carried out directly on the user's device (client), before it is encrypted or sent.
• ****Plaintext: the content of a message in its original form, not yet encrypted and therefore readable by anyone who has access to it.
• *****Perceptual hashing: a variant of hashing that recognises images or videos that are similar to each other even if slightly modified (e.g. cropped or compressed), useful for identifying copies of illegal material.
• ******Detection order: a measure issued by an authority that requires a specific platform to scan content for a limited period of time, when there is a concrete risk.
• *******Mass surveillance: indiscriminate collection and analysis of data and communications concerning an entire population, without any individual suspicion being required.
• ********Backdoor: a hidden or privileged access point inserted into a computer system, which makes it possible to bypass normal security measures, often without the end user's knowledge.
• *********Data breach: a security breach leading to the destruction, loss, alteration or unauthorised disclosure of personal data.
• **********Artificial intelligence (in this context): software models trained on large amounts of data (including chats or images) to recognise patterns and automate decisions or predictions.