EU Chat Control 1.0 (Scanning Derogation)
European Union- Proposed
- Parliament position
- Trilogue
- Adopted
The 'temporary' law behind mass scanning of Europe's messages since 2021. A majority of voting MEPs tried to block its July revival and fell short of the absolute majority needed to do it, so suspicionless scanning is law again through April 2028.
Latest update
Rejection fell 47 short of the absolute majority; regulation deemed adopted, in force to April 2028; encryption carve-out adopted, judicial-only limit failed (322)
Current position
In force to April 2028 (readopted July 9; E2EE excluded)
What it does
Chat Control 1.0 is a derogation from the ePrivacy Directive that lets providers voluntarily scan unencrypted private messages for abuse material, suspicionless and warrantless, running since July 2021. Billed as temporary, it was extended in 2024 and then lapsed on April 3, 2026 after Parliament refused a further extension. The Council brought it straight back: it fast-tracked a formally new regulation carrying the same text as its own second-reading position, and Parliament voted to skip committee review. On July 9 the motion to reject drew 314 votes to 276, a majority of those voting but short of the 361 absolute majority the procedure demands, so the regulation was deemed adopted and now runs to April 2028. Parliament did adopt an amendment excluding end-to-end encrypted services from the scanning; a separate amendment to limit scanning to judicially identified suspects drew 322 votes and failed the same absolute-majority test.
Why it matters
A scanning regime a Parliament majority voted to end came back anyway, because the second-reading rules demanded an absolute majority to say no and mere assent to say yes. That asymmetry is now a working template for outlasting the members who keep voting against it. The encryption carve-out spares WhatsApp, Signal, and Telegram from this track, while the permanent Chat Control 2.0 is where client-side scanning of those same services is still on the table.
Our take
A temporary measure is into its seventh year, revived through the one path its opponents could not close off: committee review skipped, an absolute-majority bar to clear, a formally new regulation with identical text. The carve-out for encrypted services is real and worth having, and it changes nothing about the precedent, which is that Brussels can wait out a majority that keeps voting no.
Timeline
The readopted derogation is set to expire
UpcomingRejection fell 47 short of the absolute majority; regulation deemed adopted, in force to April 2028; encryption carve-out adopted, judicial-only limit failed (322)
LatestParliament voted 331 to 304 to fast-track, bypassing committee review
Council adopted the original text as its second-reading position
EU ambassadors agreed to resurrect the expired law by expedited procedure
The derogation expired; voluntary scanning lost its legal basis
Parliament rejected the extension outright, 311 to 228 with 92 abstentions
Extension trilogue collapsed; Council rejected Parliament's conditions
Parliament compromise: extend to 2027 with targeted, judicially authorized detection only, 458 to 103
Civil liberties committee rejected the extension, 38 to 28
Commission proposed a second extension, to April 2028
First extension, to April 3, 2026
Adopted; scanning derogation begins, original expiry August 2024
Votes
- European Parliament — Compromise extension to 2027, targeted detection only (458 to 103) · March 11, 2026
- European Parliament — Rejection of the extension (92 abstentions) (311 to 228) · March 26, 2026
- European Parliament — Fast-track of the revival, bypassing committee review (331 to 303) · July 7, 2026
- European Parliament — Motion to reject the revival: a majority, but short of the 361 absolute majority, so the reading continued (314 to 276) · July 9, 2026
- European Parliament — Encryption carve-out amendment adopted with 369 votes, clearing the 361 bar; the targeted-scanning amendment drew 322 and failed · July 9, 2026