European Parliament Extends Big Tech's Message-Scanning Rights Over Objections of Most MEPs

How a Vote Against Became a Vote For

On Thursday, the European Parliament extended legislation allowing tech companies to voluntarily scan users' private messages for child sexual abuse material (CSAM). Meta, Google, and Microsoft are among the firms that regain legal permission to scan private text, email, and social media messages under the renewed rules.

More MEPs voted against the measure than voted for it. The European People's Party (EPP), the parliament's largest political group, used what critics are calling an "urgent procedure" to force the vote before parliament breaks for summer recess at the end of July. That process skips preliminary committee debate where amendments typically get introduced. More importantly, it sets the bar at an absolute majority of 361 MEPs to defeat the measure, not a simple majority of those voting. Opponents fell short by 47 votes.

The Child Safety Argument Is Real

The EPP's case deserves a fair hearing. Voluntary scanning by tech platforms has been an operational tool for identifying and rescuing victims of online child sexual abuse. EPP vice-chair Tomas Tobé told lawmakers: "We cannot go to the summer recess knowing that our children are not protected." The legal basis for this voluntary scanning expired in April, creating a gap the EPP argued left children exposed.

CSAM detection has historically relied on hash-matching technology, which compares images against known databases of illegal content rather than reading message text. Companies like Meta have used these tools to report millions of suspected violations to law enforcement annually.

The Privacy Case Is Also Real

Simeon de Brouwer, policy advisor at Brussels-based advocacy group European Digital Rights, told Wired that the legislation means "private companies may deny your right to have confidential digital conversations" and "could, if they want to, read every message you write, every email you send, every picture you share."

This applies to the voluntary framework's theoretical scope, not a blanket mandate that companies must scan everything. But the concern is grounded: a legal permission to scan is a legal permission to scan, and what companies choose to do with that authority is not fully constrained.

End-to-end encrypted services like WhatsApp and Signal are currently exempt. The platforms most used for private communication by ordinary people are not the primary targets here.

The Democratic Process Question

Former MEP and civil rights activist Patrick Breyer called the result a "farce" that "damages democracy," writing on his blog that "our children are the real losers in this undemocratic process." He compared mass surveillance to "indiscriminately opening everyone's physical mail."

Breyer's frustration with the procedural mechanism is understandable, and the tension it creates is genuine. A democratic legislature designed a rule where a measure can pass even when most members who show up to vote are against it. Whatever the child-safety rationale, that's a process worth scrutinizing.

Absolute-majority thresholds for blocking legislation are not unusual in parliamentary systems. They exist precisely to prevent a motivated minority from blocking action through strategic absences. The EPP chose this vehicle specifically because coalition talks collapsed in March and time was running out before the summer break. Whether that constitutes urgency or opportunism depends heavily on which side of the privacy debate you occupy.

What Happens Next

The reinstated permissions cover voluntary scanning through 2028, or until permanent "Chat Control" legislation replaces them, whichever comes first. That permanent framework is still being negotiated and has faced sustained opposition from privacy advocates, some EU member states, and the European Data Protection Supervisor.

The 2028 deadline means this fight isn't over. It's deferred. The permanent legislation, if it passes in a stricter form requiring mandatory scanning or breaking encrypted services, will almost certainly face legal challenges under the EU Charter of Fundamental Rights, which protects privacy and communication confidentiality.

The unresolved question heading into that debate: can a CSAM detection regime be designed narrowly enough to survive fundamental rights scrutiny, or does any form of message scanning, voluntary or mandatory, require trade-offs with privacy that European courts will ultimately refuse to permit?