The European Union has reignited a fierce debate over privacy and surveillance with the revival of its so‑called “Chat Control 1.0” framework. The measure restores a legal basis for major technology companies to voluntarily scan users’ private communications for child sexual abuse material (CSAM), months after the original temporary regime expired in April 2026. Lawmakers say the goal is to give platforms legal cover to detect and report CSAM, while critics warn it normalizes mass scanning of personal messages under the banner of child protection.
The turning point came with a European Parliament vote on 9 July, which, in procedural terms, allowed the interim regulation to return almost by default. A majority of Members of the European Parliament (MEPs) present actually voted to stop the framework, but they fell short of the absolute majority threshold needed to block it. As a result, Regulation (EU) 2021/1232, informally known as Chat Control 1.0, remains in force and again derogates from ePrivacy rules so that online services can scan communications for known and new CSAM and grooming attempts.
Under the renewed framework, scanning remains voluntary rather than mandatory, but the legal door is fully open for large platforms to resume or expand automated analysis of messages, images, and other content sent via their services. Email providers, mainstream chat platforms, gaming networks, and social networking services are among those potentially covered. Companies that choose to participate can detect, report, and remove suspected CSAM without needing a specific warrant for each account, although law enforcement bodies themselves still require judicial authorization for targeted surveillance activities.
One important limitation is that the revived rules do not extend to end‑to‑end encrypted (E2EE) messaging services such as Signal and, under current language, other providers using comparable encryption. That exemption is seen as a partial victory for digital rights advocates and cryptographers, who argue that any obligation to scan encrypted chats would undermine the core security guarantees of E2EE. However, opponents of Chat Control insist that even voluntary scanning on non‑encrypted platforms creates a dangerous precedent for generalized monitoring of interpersonal communications.
The renewed validity of Chat Control 1.0 runs until 2028 or until a permanent framework, widely referred to as Chat Control 2.0, is agreed and adopted. In the meantime, the EU faces a difficult balancing act between aggressively combating online child abuse and upholding fundamental rights to privacy and confidentiality in digital communications. The outcome of this debate will shape how far governments can push platform‑level surveillance in the name of safety, not just in Europe but as a global policy benchmark.