European Parliament moves to exclude end-to-end encrypted chats from CSAM scanning regime

The European Parliament has voted to exclude end-to-end encrypted messaging services from a temporary EU regime that allows voluntary scanning of online communications for child sexual abuse material. The amendments passed on 9 July by narrow margins, with two key votes carried by 369 and 362 MEPs, according to Euronews.

The temporary scheme—criticised as “chat control” by opponents—lets electronic communications providers deploy voluntary detection measures under a derogation from EU e-privacy rules. End-to-end encryption, used by services such as WhatsApp and Messenger, means only sender and recipient can read message contents; excluding those services from the derogation narrows what providers can lawfully scan without redesigning how private communications work.

The vote lands in the middle of a procedural tug-of-war between EU institutions. Euronews reports that the European Commission has proposed extending the temporary scanning framework until 2028, and that extension still requires approval by both the Parliament and member states. Parliament had already voted against an extension in March 2026, allowing the derogation to expire on 3 April, before the proposal returned after pressure from EU governments and encouragement from Parliament president Roberta Metsola.

In Parliament, the centre-right European People’s Party tried to push the extension through unchanged using a rarely used procedure that would have required an absolute majority—at least 361 MEPs—to reject or amend it. Instead, a majority backed amendments that “drastically restrict” the scheme’s scope, Euronews writes, and those changes are now unlikely to be accepted by EU governments. The coalition that carried the amendments was also unusual: liberals, the radical left, and far-right parties voting together, outnumbering the EPP and the centre-left Socialists and Democrats. The close margins exposed internal fractures, including among Socialists; Euronews notes that many Socialist MEPs, including German rapporteur Birgit Sippel, voted for the amendments and were decisive.

What happens next is less about slogans than about engineering and liability. If governments want scanning to be meaningful at scale, they will keep running into the same constraint: the more a system preserves private, user-controlled encryption, the less providers can inspect content without building new points of access. If providers are asked to “voluntarily” scan while also being blamed when they do not, the risk shifts from criminals to platforms and, ultimately, to users through product design.

The Parliament’s amendments are not the final law. But on Thursday, a handful of votes were enough to draw a line around end-to-end encryption—at least for the temporary extension now moving into negotiations with member states.