Chat Control: The Majority Voted No — and Lost Anyway

Status: 18 July 2026. The legislative process is still under way, so the legal position may change again. This article will be updated.

The majority voted no. It lost anyway.

On 9 July, the European Parliament voted at second reading on the return of the “temporary” ePrivacy derogation — the rule that lets communications services “voluntarily” run automated, suspicionless scans of private messages for child sexual abuse material and grooming. The motion to reject the Council’s position outright received 314 votes in favour against 276 opposed, with 17 abstentions.

A clear majority of the members voting wanted to stop the law. It wasn’t enough. At this stage of the procedure, rejection requires an absolute majority of all 720 MEPs — 361 votes. It fell 47 short. A surveillance law survived against the majority of votes cast, because absent members effectively count as yes. If you ever wondered why the cypherpunks never took government assurances about private communications on faith: this is the exhibit.

The timing was no accident either. The file, which had expired in April, was revived at short notice in late June and fast-tracked into the start of the summer recess — a window in which absolute majorities are notoriously hard to assemble.

The one real win: encryption stays out

Parliament did not simply wave the Council’s position through — it amended it. The key amendment: communications to which end-to-end encryption is, has been, or will be applied are excluded from scanning. No breaking it open, no reading before encryption, no backdoor through the side door.

That is not a detail; it is the defensive line. End-to-end encryption is mathematics, and mathematics has no “good guys only” exception: either only the recipient can read the message, or the promise is broken — for everyone, forever. Cryptographers have been putting exactly this into open letters to lawmakers for years.

The caveat: the carve-out only holds if the Council accepts Parliament’s amendments.

What is not (yet) in force

The interim derogation that expired in April 2026 was not immediately reactivated by this vote. The amended text now sits with the Council, which has three months — until early October. If it accepts all the amendments, the measure is adopted and would run until 3 April 2028. If it rejects any part, Parliament and Council enter conciliation.

The European Parliament’s press release of 9 July 2026 records the official procedural status and voting figures.

Why “voluntary” should reassure no one

Protecting children and prosecuting abuse material are vital public responsibilities — nothing here relativises that. The question is not the goal but the tool: “voluntary” scanning means, in practice, that large platforms run private communications through classifiers at scale, with no suspicion required. That inverts a basic principle — suspicion no longer triggers the search; the search goes looking for suspicion. False positives arrive at law enforcement as private photos and family chats, and every scanning infrastructure, once built, invites the next purpose.

Eric Hughes put it plainly in the 1993 Cypherpunk’s Manifesto: “Privacy is necessary for an open society in the electronic age.” Privacy is not about hiding; it is the freedom to decide who gets to read along. The confidentiality of correspondence was never a concession to criminals — it is a precondition of open societies.

Chat Control 2.0 is already waiting

The current fight is only the opening act. In parallel, the permanent CSA Regulation (“Chat Control 2.0”) is being negotiated — and there, the question remains on the table whether end-to-end encrypted services should be covered via client-side scanning: searching messages directly on the device, before encryption takes effect. Parliament wants detection orders limited to specific suspects and subject to judicial authorisation; the Council favours “voluntary” suspicionless detection plus risk-mitigation duties that can amount to the same thing. The supposedly final negotiating round on 29 June 2026 collapsed on precisely this point; talks resume in the autumn under the Irish Council presidency. Former MEP Patrick Breyer maintains a running chronicle.

What remains in your own hands

The cypherpunks did not answer the first round of the Crypto Wars in the nineties with petitions, but with a principle: “Cypherpunks write code.” Laws change with majorities and procedural manoeuvres — well-implemented encryption does not. In practice that means: end-to-end encrypted messengers as the default, treating email as a non-confidential channel where confidentiality matters, and infrastructure where the keys stay with you rather than with a platform that might “voluntarily” scan tomorrow. Set up your communications and data that way, and you are no longer negotiating over who gets to read along.

We are following the procedure and will update this article once the Council has decided.