Strasbourg: Europe will keep letting companies scan private messages for child abuse imagery until 2028, after lawmakers tried to stop the practice and narrowly missed the votes to do it.
The rule at issue lets messaging services voluntarily search unencrypted chats for known abuse material, a carve-out from Europe’s privacy law that campaigners call chat control. Parliament rejected an extension in March, the derogation lapsed in April, and the Council then revived it unchanged through April 2028. A parliamentary bid to kill the revival in July drew more votes against than for, yet fell short of the absolute majority a second reading demands, so the scanning stands. The activist campaign tracking the file has documented every twist.
The result satisfies almost no one. Child protection groups wanted a permanent, stronger regime and got a temporary patch. Privacy advocates wanted the scanning gone and watched it return by procedure. The outcome captures how uneasily Europe balances two goods it refuses to rank openly.
What the rule does and does not touch
The scanning applies only to messages a platform can already read. End-to-end encrypted traffic, the kind that carries most private conversation, stays out of reach, because a service that cannot see a message cannot scan it. That technical fact blunts both the hopes of those who want total coverage and the fears of those who imagine every chat surveilled.
The harder fight concerns the permanent regulation that would replace this stopgap. Negotiators have tried five times to agree a lasting law, and the fifth attempt collapsed in late June with talks pushed to September. The sticking point is encryption. Any rule that forces platforms to scan protected messages would demand breaking or bypassing the encryption that secures banking, journalism and dissent alike.
Why the deadlock persists
The impasse is not a failure of drafting but a genuine clash of values. Investigators argue that encrypted channels have become a refuge for offenders, and that a right to privacy cannot mean a right to trade abuse imagery unseen. Security researchers reply that a scanning mandate builds a surveillance tool that any future government, or any attacker who compromises it, could turn against ordinary citizens.
Both sides describe the same technology and reach opposite conclusions, which is why the file keeps stalling. No clever wording lets a state read protected messages for one purpose while guaranteeing it can read them for no other. The choice is closer to binary than legislators would like to admit.
For now, Europe lives with a compromise that pleases neither camp and settles nothing. The temporary rule buys time until 2028, the permanent one waits for a September that may again end without agreement, and the underlying question stays open. A continent that prizes both privacy and child safety has not found a way to honour both at full strength, and the next round of talks will test whether it ever can. The debate around message scanning is, at bottom, a test of how much surveillance a democracy will license in the name of protection.
