Four years of negotiation over child sexual abuse material online have produced one temporary rule, one failed vote, and no permanent law. Negotiators resume the file at the end of September, and the version they inherit differs sharply from the one the Commission tabled in 2022.
The immediate change concerns the interim regime that lawyers call the ePrivacy derogation and everyone else calls chat control. It permits platforms to scan messages voluntarily for abuse material, which ordinary confidentiality rules would otherwise forbid. The Council adopted its first-reading position on 2 July, extending that permission from 3 August 2026 to 3 April 2028. An amendment carried the same day removed communications protected by end-to-end encryption from the scope of voluntary scanning, which places WhatsApp, Signal and Telegram formally outside the temporary regime.
Parliament tried to stop the extension and failed on a technicality that deserves attention. On 9 July, 314 members voted against continuing the derogation and 276 voted to keep it. A second-reading rejection requires an absolute majority of all members, 361 votes, not a majority of those present. The measure survived because opposition to it fell 47 votes short of a procedural threshold, not because a majority supported it. Digital rights groups read the result as a warning shot rather than a defeat.
That vote now shapes the permanent regulation. The fifth trilogue collapsed on 29 June without agreement, and the sixth is scheduled for 29 September under the Irish presidency. Institutions have settled most of the text. They have not settled the part that matters: whether detection orders will be mandatory or voluntary, whether they may target defined suspects or apply across a whole service, and whether encrypted platforms fall inside or outside their reach.
Encryption is where the file keeps breaking. Investigators argue that offenders migrate to encrypted services precisely because those services cannot be inspected, and that a law exempting them writes the escape route into the statute. Cryptographers reply that scanning an encrypted message requires inspecting it before encryption on the user’s own device, which reintroduces a vulnerability that any sufficiently motivated actor can exploit. No implementation has yet reconciled the two positions, and European lawmakers have spent four years discovering that.
Meanwhile the practical situation has grown odd. The temporary rule permits scanning until April 2028 but no longer covers the encrypted platforms where much of the traffic sits. Companies operating unencrypted services continue to scan and report. Companies operating encrypted ones do not. Child protection organisations point out that reporting volumes reflect where scanning happens rather than where abuse happens, a distinction that has been badly served in the public argument on both sides.
European Digital Rights, which maintains the fullest public record of the file, notes that the September round leaves negotiators little room. The Parliament that nearly killed the temporary measure must eventually approve the permanent one, and the arithmetic from 9 July suggests a mandatory scanning obligation covering encrypted services would struggle to pass. Council negotiators know this. Whether they concede it before the deadline or after another collapsed trilogue is the only real question left on the file.
