EU Parliament Revives Chat Control 1.0 to Scan Private Messages

On 9 July, the European Parliament revived Chat Control 1.0 to scan private messages for CSAM.

The move restores the interim derogation from the ePrivacy Directive Regulation 2021/1232, signaling a return to a framework that would authorize voluntary, indiscriminate scanning of private communications for known and new Child Sexual Abuse Material and for the solicitation of children. The decision came via an urgent procedure designed to fast track a measure Parliament had rejected just a few months earlier, a maneuver described by diplomats and experts as unprecedented and heavily criticized for overstepping Parliament’s mandate. The timing was deliberate: the vote occurred on the last sitting day before the summer recess, framed as a second reading, which requires an absolute majority of the Parliament’s full membership (361 votes) to block the Council’s text. In the end, the threshold wasn’t met, so the Council text passed automatically without an active endorsement from Parliament. The result reflected broad opposition to the proposal, yet it also underscored the fragility of parliamentary consensus under procedural pressure. Two amendments were adopted to preserve end-to-end encryption, a signal at least in part to shield core privacy guarantees from the derailment critics have long warned about.

Observers say the revival could jeopardize the long term framework for how privacy and security are balanced in the digital space. The move arrives barely a week after a final trilogue round and highlights the friction between robust child protection measures and the EU’s commitment to strong privacy protections and encryption. For anyone steering a compliance program or tech strategy in Europe, the decision lays down a high-stakes context for upcoming deployments, governance questions, and vendor negotiations. The status of any mandatory action remains murky because the derogation is interim and the specific implementation rules, technical standards, and enforcement pathways will be spelled out in forthcoming texts and national transpositions. In practice, this means platform operators could face new expectations around scanning workflows, data handling, and risk controls, even as the security architecture remains tethered to encryption protections.

From a practitioner standpoint the most salient implications revolve around constraints, tradeoffs, and watchpoints. First, the voluntary nature of the scanning regime means there is no blanket mandate forcing every service to deploy signals-based detection; however, the accompanying political momentum creates a de facto pressure on major providers to offer compatible features or risk regulatory pushback. Second, the encryption protections introduced by the two amendments are a reminder that the debate is not simply about scanning versus privacy; it is about how to reconcile detection capabilities with the confidentiality guarantees that consumers rely on. Compliance teams should expect clarifications on what constitutes “indiscriminate” scanning in practice, how data is handled and stored, and what transparency and audit rights accompany any operator-initiated scanning. Third, the enforcement picture remains unsettled. The Parliament’s delay in endorsing the Council plan, coupled with the urgency machinery used, means enforcement will hinge on the final text from trilogue and the way member states implement it through national law. Finally, what happens next is uncertain but crucial: further negotiations could adjust the scope, tighten safeguards, or reframe how end-to-end encryption is preserved while pursuing CSAM detection.

What to watch next: the trilogue outcome and the exact language on encryption safeguards, the timeline for any national transpositions, and how enforcement will be measured in practice. The episode also sets a marker for the balance between child protection and privacy in the EU’s digital policy, a tension that will shape compliance programs and platform design for years to come.