Chat control without cause: EU Parliament extends transitional regulation – but there are restrictions | News

In April of this year, a transitional regulation expired in the European Union, which gave major Internet platforms the legal opportunity to scan private chats for depictions of child sexual abuse. This extended not only to messenger services such as WhatsApp, Signal or Apple’s iMessage, but also to emails and cloud services. The searches could be carried out without specific suspicion and voluntarily, so they were not mandatory. The EU Parliament has now reactivated the chat control without cause by extending the exemption by around two years. However, MPs decided on two restrictions.

Unprovoked chat control is intended to combat child sexual abuse
The purpose of the unprovoked chat control is to combat child sexual abuse. However, critics see great dangers in this, as such surveillance measures are all too easily transferred to other areas and could therefore massively threaten the freedom of citizens. However, some large tech companies (not only) in the European Union are pushing to be allowed to search content automatically, which they are actually not allowed to do under data protection laws. The exemption now reactivated and extended by the EU Parliament offers companies such as Microsoft, Google and Meta at least the legally secure option to carry out such scans.

No searching of end-to-end encrypted chats
However, the extension of the exception regulation by Parliament only came about because of one special feature. In order to reject the EU Council’s proposal, an absolute majority of MEPs was required. However, there were far from the necessary 360 no votes: in the decisive vote on July 9, 2026, only 276 voted for rejection, 286 against, and 30 parliamentarians abstained. The application to extend the exemption was therefore considered accepted. However, according to the European Parliament’s press release, two amendments received a majority. On the one hand, chat control should not extend to end-to-end encrypted communication. This would exclude WhatsApp and Apple iMessage, for example. In addition, there should be no client side scanning, so browsing content on devices such as smartphones or tablets remains prohibited.

The EU Council now has three months to approve or reject the two changes. If the Council does not accept all the changes, an agreement on the law must be reached in a mediation committee.