A majority of the European Parliament voted to reject a Council-backed scanning measure for child sexual abuse material. It became law anyway. That outcome is not a matter of interpretation or spin - it is the documented result of Regulation (EU) 2026/1881, now in force until 3 April 2028, and it exposes a procedural mechanism in EU lawmaking that few outside Brussels had reason to understand until now.
The regulation permits qualifying online providers to voluntarily detect, report, and remove child sexual abuse material, carving out a temporary exception to the confidentiality protections of the ePrivacy Directive. For anyone relying on encrypted messaging, or researching how to keep communications private in the first place, the fine print of this debate has suddenly become practical rather than academic - readers weighing their options might find it useful to consult that guide before assuming their current setup is unaffected. The Commission presents the measure as a proportionate child-protection tool. Civil-liberties groups call it a surveillance framework that advanced through a procedural gap rather than genuine parliamentary consent.
How a Rejected Measure Became Law
Parliament's history with this file was already fraught. On 26 March 2026, MEPs voted 228 in favor of rejecting an earlier extension against 311 opposed, and the prior temporary regime lapsed on 3 April 2026. The Council then adopted its own position and sent the file back for a second reading.
In that second reading, 314 MEPs voted to reject the Council's position, 276 voted against rejection, and 17 abstained. A straightforward count makes the outcome look decisive: opposition outnumbered support. But EU second-reading procedure does not work on simple majorities of votes cast. Blocking a Council position requires an absolute majority of the Parliament's full membership - a threshold reported at roughly 360 votes. Opponents reached 314. The measure proceeded not because it won an affirmative vote, but because its opponents fell short of a bar most citizens have never heard of.
The Encryption Carve-Out, and Its Limits
Parliament did secure one substantive concession. Its amended position excludes interpersonal communications to which end-to-end encryption "has been, is, or will be applied," language the Council accepted. That exclusion matters: it signals that lawmakers recognized encrypted channels deserve different treatment than ordinary, unencrypted services.
The wording leaves real questions unanswered. How a provider determines which services qualify for the exclusion remains unsettled in practice. Whether the carve-out protects an entire communication channel or only isolated messages within it is likewise unresolved. Organizations such as EDRi argue that normalizing voluntary scanning powers, even narrowly targeted ones, erodes the baseline of confidentiality that encrypted systems are built to guarantee. That erosion does not require a single dramatic breach - it can happen gradually, through architecture built for one purpose that quietly expands to another.
What the 2028 Deadline Actually Means
The expiration date is not a resolution. It is a deadline by which negotiators must settle what this temporary measure left ambiguous, as talks over a permanent "Chat Control 2.0" framework continue. Those negotiations now inherit three unresolved problems: contested encryption language, a precedent of binding legislation advancing without an affirmative parliamentary majority, and an open technical question about whether detection systems can coexist with strong end-to-end encryption without weakening it over time.
The procedural mechanics deserve scrutiny independent of where anyone stands on scanning itself. A rule requiring an absolute majority to block legislation, rather than a simple majority to pass it, can let a measure take effect even when more elected representatives oppose it than support it. That is a structural accountability gap, and it will shape how permanent EU digital-privacy law is written long after this particular deadline passes.
