EU Chat Control 1.0: Child Protection Measure or the Start of Something Bigger
Maryam Tariq
On July 9, 2026, the European Parliament revived Chat Control 1.0, a regulation that allows tech companies to voluntarily scan private, unencrypted messages, emails and files for child sexual abuse material, known as CSAM. It will remain in force until April 3, 2028. On paper, this is a child safety measure. But the way it passed, and the pattern it fits into, is prompting a harder question among privacy researchers and digital rights groups: is this really about protecting children, or is child protection the easiest justification for building something much larger.
How the European Parliament Vote Actually Went
Of 607 members who voted, 314 supported rejecting the law, 276 voted to keep it, and 17 abstained. That is more votes against Chat Control than for it. But under the procedural rules for this stage of EU lawmaking, rejecting a Council position required an absolute majority of all 720 seats, currently 361 votes, not simply a majority of those present. The rejection fell 47 votes short. Because that threshold was not reached, the Council’s original text was automatically treated as adopted. Many MEPs were absent for the start of summer recess, meaning empty seats functioned, in effect, as support for the law.
This was not the first rejection. Parliament voted against extending Chat Control in March 2026 as well, and the previous version expired on April 3 that year. The Council reopened the file in early July, sending it back to Parliament at a point when assembling an absolute majority to block it a second time proved difficult.
What the CSAM Scanning Rules Actually Cover
Chat Control 1.0 applies to unencrypted or server side encrypted services, including Gmail, iCloud Mail, Skype, Snapchat and Instagram direct messages. WhatsApp and Signal remain exempt because they use full end to end encryption. Detection relies mainly on hash matching tools like PhotoDNA, which flag known illegal files rather than reading conversation text. Critics note the encryption exemption changes little in practice, since providers were not scanning those apps before either. The Council itself describes the law as an exception to existing data protection rules in electronic communications, the very rules that have led to fines for companies in the past.
The Function Creep Argument Driving the Backlash
This is where the debate shifts from child safety to something broader. Analysts describe a concept called function creep, where a tool built for one narrow, defensible purpose gradually gets extended to other uses once the infrastructure already exists. One recent analysis places Chat Control alongside two other EU digital projects moving forward around the same time, the digital euro and a new age verification app for accessing online platforms. Each is justified on its own terms, monetary sovereignty for the digital euro, protecting minors for age verification, stopping abuse material for Chat Control. Individually, each argument is hard to reject. Together, they form one infrastructure capable of tracking identity, money and private conversations at the same time.
The concern is not that today’s law targets political dissent or something unrelated to child safety. It does not. The concern is what comes after. Analysts sketch a familiar sequence once scanning infrastructure and legal precedent exist: an exception for abuse material, then terrorism, then hate speech or disinformation, then eventually any category political authorities decide counts as a public risk. None of this requires assuming bad intentions from lawmakers today. Infrastructure tends to outlive the people who built it and the reasons they built it for.
What Comes Next for Chat Control 2.0
This vote covers only the temporary derogation. The permanent framework, often called Chat Control 2.0, has been negotiated since 2022 and remains unresolved. Talks between Parliament, the Council and the Commission resumed in June 2026 without agreement, with further rounds expected in September. That negotiation, not this vote, will determine whether the current scanning framework becomes a permanent feature of how the EU regulates private communication, and how far its scope eventually extends beyond child safety.
Sources:
· From Digital Euro to Chat Control: The Risk of Function Creep — The European Conservative: https://europeanconservative.com/articles/analysis/from-digital-euro-to-chat-control-the-risk-of-function-creep/
· Chat Control 1.0 passed the European Parliament, through the back door — Euronews: https://www.euronews.com/next/2026/07/10/chat-control-10-passed-the-european-parliament-through-the-back-door
· EU Parliament Passes Chat Control by Default — Tech Times: https://www.techtimes.com/articles/320010/20260709/eu-parliament-passes-chat-control-default-314-meps-couldnt-block-scanning-law.htm
· EU Chat Control snoopfest returns after vote to kill it falls short — The Register: https://www.theregister.com/security/2026/07/09/meps-fail-to-prevent-chat-control-snoopfest-revival/5269379
· EU Chat Control 2026: The Vote That Passed and Failed at the Same Time — Hive Security: https://hivesecurity.gitlab.io/blog/eu-chat-control-2026-vote-against-majority/
· EU Parliament greenlights Chat Control 1.0 — Patrick Breyer: https://www.patrick-breyer.de/en/eu-parliament-greenlights-chat-control-1-0-breyer-our-children-lose-out/
