EU revives chat scanning rules but exempts encrypted messages

The European Parliament has backed temporary rules allowing technology companies to scan private communications voluntarily for child sexual abuse material until 2028.

However, lawmakers also approved an amendment excluding messages protected by end-to-end encryption. The amended proposal will now return to the Council of the European Union for review.

EU lawmakers fail to block chat scanning extension

Parliament voted on July 9 to revive the temporary legal framework known as “Chat Control 1.0” by its critics. The previous rules expired in April while European institutions continued negotiations over a permanent system.

According to the official voting record, 314 lawmakers voted to reject the Council’s position, while 276 voted against rejection. Another 17 abstained. However, opponents needed an absolute majority of 361 votes to stop the proposal.

As a result, the legislation advanced even though more lawmakers voted against the Council’s position than supported it. The rules allow online service providers to detect, remove and report suspected child sexual abuse material voluntarily.

Supporters say the framework gives platforms legal grounds to identify and report abusive content. Meanwhile, privacy groups argue that broad scanning could expose private communications belonging to users who are not under investigation.

End-to-end encrypted chats receive exemption

Parliament also approved an amendment stating that the scanning framework should not cover communications protected by end-to-end encryption.

The encryption amendment received 369 votes in favor, 236 against and six abstentions. End-to-end encryption prevents platforms and outside parties from reading messages while they move between senders and recipients.

The exemption applies to communications “to which end-to-end encryption is, has been or will be applied,” according to the text adopted by Parliament.

Pirate Party lawmaker Markéta Gregorová described the outcome as “a bittersweet victory.” In a Greens/EFA statement, she said protecting encryption had been a priority, but added that “voluntary mass scanning unfortunately passed.”

The amended proposal will now return to EU member states. The Council can approve Parliament’s changes or reject them and begin another round of negotiations.

Crypto groups warn about wallet security

The vote has also drawn attention from the crypto industry because wallet users rely on secure devices and encrypted services to protect private keys, passwords and recovery phrases.

Blockchain groups warned that client-side scanning could create new security risks. Client-side tools inspect messages, photographs or files on a device before encryption protects them.

The International Association for Trusted Blockchain Applications said such systems could expose wallet seed phrases, session keys and other sensitive data. Attackers could also target scanning software if it gains broad access to files stored on users’ devices.

The group also raised doubts about the effect on open-source developers. Wallet and decentralized application developers could face added compliance duties even when they do not control the networks on which their software operates.

Ethereum co-founder Vitalik Buterin also criticized the proposal before the vote. As reported by crypto.news, he wrote, “They are trying to push Chat Control through again.”

Permanent chat control talks continue

The temporary framework is separate from the proposed permanent regulation known as “Chat Control 2.0.” Negotiations on that wider law are expected to resume in September.

Lawmakers still disagree over whether detection measures should target suspected users or apply broadly across communication services. They are also debating how authorities can combat abusive content without weakening encryption.

For now, Parliament’s amendment protects services using end-to-end encryption from the temporary scanning framework. Providers may still conduct voluntary checks on communications that do not receive that protection.

However, the law has not completed the EU legislative process. The Council’s response will determine whether the extension takes effect in its amended form or returns for further talks.