EU Chat Control 1.0 (Scanning Derogation)
What it does
Chat Control 1.0 is a derogation from the ePrivacy Directive that lets providers voluntarily scan unencrypted private messages for abuse material, suspicionless and warrantless, running since July 2021. Billed as temporary, it was extended in 2024 and then lapsed on April 3, 2026 after Parliament refused a further extension. The Council brought it straight back: it fast-tracked a formally new regulation carrying the same text as its own second-reading position, and Parliament voted to skip committee review. On July 9 the motion to reject drew 314 votes to 276, a majority of those voting but short of the 361 absolute majority the procedure demands, so the regulation was deemed adopted and now runs to April 2028. Parliament did adopt an amendment excluding end-to-end encrypted services from the scanning; a separate amendment to limit scanning to judicially identified suspects drew 322 votes and failed the same absolute-majority test.
Why it matters
A scanning regime a Parliament majority voted to end came back anyway, because the second-reading rules demanded an absolute majority to say no and mere assent to say yes. That asymmetry is now a working template for outlasting the members who keep voting against it. The encryption carve-out spares WhatsApp, Signal, and Telegram from this track, while the permanent Chat Control 2.0 is where client-side scanning of those same services is still on the table.
Our take
A temporary measure is into its seventh year, revived through the one path its opponents could not close off: committee review skipped, an absolute-majority bar to clear, a formally new regulation with identical text. The carve-out for encrypted services is real and worth having, and it changes nothing about the precedent, which is that Brussels can wait out a majority that keeps voting no.
Votes
- European Parliament — Compromise extension to 2027, targeted detection only (458 to 103) · March 11, 2026
- European Parliament — Rejection of the extension (92 abstentions) (311 to 228) · March 26, 2026
- European Parliament — Fast-track of the revival, bypassing committee review (331 to 303) · July 7, 2026
- European Parliament — Motion to reject the revival: a majority, but short of the 361 absolute majority, so the reading continued (314 to 276) · July 9, 2026
- European Parliament — Encryption carve-out amendment adopted with 369 votes, clearing the 361 bar; the targeted-scanning amendment drew 322 and failed · July 9, 2026
Timeline
- July 14, 2021Adopted; scanning derogation begins, original expiry August 2024
- April 29, 2024First extension, to April 3, 2026
- December 18, 2025Commission proposed a second extension, to April 2028
- March 2, 2026Civil liberties committee rejected the extension, 38 to 28
- March 11, 2026Parliament compromise: extend to 2027 with targeted, judicially authorized detection only, 458 to 103
- March 18, 2026Extension trilogue collapsed; Council rejected Parliament's conditions
- March 26, 2026Parliament rejected the extension outright, 311 to 228 with 92 abstentions
- April 3, 2026The derogation expired; voluntary scanning lost its legal basis
- June 26, 2026EU ambassadors agreed to resurrect the expired law by expedited procedure
- July 2, 2026Council adopted the original text as its second-reading position
- July 7, 2026Parliament voted 331 to 304 to fast-track, bypassing committee review
- July 9, 2026Rejection fell 47 short of the absolute majority; regulation deemed adopted, in force to April 2028; encryption carve-out adopted, judicial-only limit failed (322)
- April 3, 2028The readopted derogation is set to expire
Related bills
Our coverage: all chat-control stories