On 9 July 2026, the European Parliament voted on whether the voluntary scanning of private messages should come back. 314 MEPs said no. 276 said yes. Scanning came back anyway.
Two weeks later the result was signed into law as Regulation (EU) 2026/1881: providers of mail and chat services may once again scan private communications for child sexual abuse material, without suspicion, until 3 April 2028. And this autumn the negotiators return to the table to settle the permanent version: one built on obligations, not permissions. Here is who actually decides, and by what rule.
The claim
“Parliament approved the return of Chat Control.” That is how it was widely reported, and it is not quite what happened. Parliament failed to reject it. Under EU procedure, that is a very different thing.
In March, Parliament had actually said no, and the old legal basis lapsed on 3 April 2026. For almost four months, suspicionless scanning had no legal cover in the EU. Then came the second reading of the Council’s position, under urgent procedure: at that stage Parliament can only reject or amend the text, and either move requires an absolute majority of all MEPs. The rejection gathered 314 votes, with 276 against and 17 abstentions, short of that majority. Parliament did adopt amendments that exclude end-to-end encrypted communications, and the Council accepted them on 23 July. On the core question, though, the Council’s text prevailed, because more votes than the other side is not enough at second reading.
Who decides?
Not the majority of those voting. The threshold decides. 607 members cast a vote that day; over a hundred seats stayed silent, and in a second reading every silent seat counts, in effect, for the Council’s position. A No that wins the room can still lose the rulebook.
This autumn the decision moves to an even smaller room: the trilogue. Negotiators for the Council (chaired by the Irish presidency), for the Parliament and for the Commission will try to finish the permanent regulation, known as the CSA Regulation, or Chat Control 2.0. Five rounds have not produced a deal; the “final” one ended on 29 June with compromises on almost everything except a single question: may scanning target everyone, or only people a judge has named? Talks resume in September, and an adoption push is expected in October. Germany’s position in the Council is widely seen as the swing vote.
By what rule?
The vote itself ran on the EU’s ordinary legislative procedure: at second reading, rejecting or amending the Council’s position takes an absolute majority of all members, not of votes cast. The law that resulted, Regulation 2026/1881, is a temporary derogation from the ePrivacy Directive: adopted on 24 July, in force since 31 July, expiring on 3 April 2028. It permits scanning by mail and messaging services; it does not require it, and end-to-end encryption stays out of its scope. We unpacked that distinction in Two laws, one nickname.
The permanent CSA Regulation would swap permission for obligation: detection orders, risk-mitigation duties, and, in the Council’s draft, room for suspicionless detection that remains “voluntary” on paper while the surrounding duties push providers firmly toward it. The Parliament’s negotiating position wants the opposite: detection only by targeted judicial order, and encryption left alone.
Who pays the price?
Users of the services where voluntary scanning has historically run: Gmail and iCloud Mail, Facebook and Instagram Messenger, Snapchat, Skype, Xbox: the unencrypted channels. Their private messages can again be checked without any individual suspicion, and a false positive lands on a real person: a family photo, a medical image, a joke taken out of context, forwarded to a reviewer the sender will never meet.
Children pay too, in a quieter way: a debate that began about protecting them has turned into a years-long argument about surveillance infrastructure, while the 322 votes for judicially targeted detection, the option most likely to survive a court challenge, keep falling just short of the procedural bar.
What does it mean for you?
Right now: if you use an unencrypted mail or chat service from the list above, your messages may lawfully be scanned again, without suspicion, until April 2028, or until the permanent regulation replaces the rules. End-to-end encrypted apps such as Signal or WhatsApp are not covered by the current derogation.
What to watch this autumn: the September trilogue round; the expected October adoption window; Germany’s stance in the Council; and one question above all: do detection orders end up targeted at named suspects, or aimed at everyone? If the Council’s shape prevails, the question quietly shifts from “may they scan?” to “must they?”
Is there another way?
Yes, and it even won the most votes. Scanning ordered by a judge, against named suspects, drew 322 MEPs in July; it failed only against the absolute-majority bar. It remains Parliament’s line for the autumn talks. Whether it survives depends on a handful of governments, and on whether anyone is still watching when the vote lands between other headlines.
We are watching. This is the fourth part of our Who Decides? series. See also the Chat Control 1.0 saga and Prove your age. Key sources: EUR-Lex, Euronews, CDT Europe, fightchatcontrol.eu.
Correction, 4 September 2026: an earlier version of this article gave the absolute majority as 361 votes, described the 29 June round as having collapsed, and said the Council’s text became law by default. The Parliament’s press office put the bar at 360 that day, its negotiating team reported compromises on almost the entire Regulation with detection left open, and Parliament adopted amendments on encryption that the Council accepted on 23 July. The full account is in The Council’s lawyers said no. Chat Control went voluntary.
