Europe’s fight over scanning private messages took a strange turn on 9 July 2026, when the European Parliament kept the bloc’s chat control regime alive even though more lawmakers in the room voted to scrap it than to save it.
The numbers tell the story. MEPs split 314 against the measure and 276 for it, yet the derogation survived. The procedure demanded an absolute majority of all 720 members, or 361 votes, to strike it down. Opponents fell 47 short, so every empty chair and abstention effectively counted as a yes.
The rule at stake lets messaging and email providers voluntarily scan for child sexual abuse material, or CSAM. Lawmakers first passed the temporary derogation in 2021 as a stopgap while the Commission and Council wrangled over a permanent law. That permanent file has stalled for years, so Parliament again reached for the temporary fix rather than let the legal basis lapse.
Privacy campaigners had celebrated too early. Hours before the final tally, a bloc of MEPs used a procedural manoeuvre to force the fresh vote, and early signals suggested the chamber might finally bury the measure. Instead the maths of absolute-majority voting rescued it, and the derogation will now run until 3 April 2028.
The July text did carry one concession that critics had demanded for years. Lawmakers wrote in an explicit carve-out for end-to-end encrypted communications, placing services such as encrypted messengers outside the scanning regime. Digital rights groups have long warned that any mandate to inspect encrypted chats would force providers to weaken the encryption for everyone.
Supporters framed the outcome as a pragmatic win for child safety. Without the derogation, they argued, platforms would lose their legal cover to detect and report abuse imagery, and investigators would go dark on a major stream of tip-offs. Groups that track online exploitation lobbied hard to keep the tool running.
Opponents see a democratic embarrassment. They point out that a measure touching the private correspondence of hundreds of millions of Europeans stayed on the books despite a floor majority against it, purely because of how the Parliament counts absentees. That, they argue, hands the next debate a legitimacy problem before it even starts.
The reprieve buys time rather than settling anything. The Commission still wants a durable law, and the Council remains divided over whether detection orders should ever reach into private messages. With the clock now set for spring 2028, the institutions face the same unresolved question they have dodged since 2021: how to police the worst material online without turning every inbox into a search target.
For now the answer is a holding pattern. The latest vote keeps the scanning option legal, shields encrypted apps, and pushes the real reckoning past the current mandate’s midpoint. Campaigners on both sides already treat 2028 as the deadline that matters.
