What Happened to "Chat Control": EU Parliament Stops Mass Surveillance?

The concept of "Chat Control" in the European Union refers to a series of legislative proposals aimed at combating child sexual abuse material (CSAM) online. The debate has largely revolved around balancing the critical need for child protection with fundamental rights to privacy and the security of encrypted communications. The initial phase, often called "Chat Control 1.0," was a temporary derogation from the ePrivacy Directive, adopted in July 2020, which allowed online service providers to voluntarily scan private communications for CSAM.

In May 2022, the European Commission introduced a more ambitious and permanent proposal, the Regulation to Prevent and Combat Child Sexual Abuse (CSAR), quickly dubbed "Chat Control 2.0." This proposal initially sought to impose mandatory detection obligations on service providers, potentially including client-side scanning that would analyze content on a user's device before encryption. This aspect drew widespread criticism from privacy advocates, cybersecurity experts, and even the European Data Protection Supervisor, who warned of an "existential catastrophic risk" to end-to-end encryption and the creation of a mass surveillance infrastructure.

Throughout 2023 and 2024, the European Parliament consistently adopted a position that prioritized fundamental rights, advocating for targeted measures based on judicial warrants rather than indiscriminate mass scanning. In November 2025, the Council of the EU (representing member states) finally agreed on its negotiating position for the permanent CSAR. While this position removed the explicit requirement for mandatory scanning of encrypted messages, it still allowed for "voluntary" detection on non-encrypted services and emphasized risk assessment and mitigation.

As the temporary "Chat Control 1.0" was set to expire on April 3, 2026, the European Commission proposed an extension until April 2028 to bridge the gap until the permanent CSAR could be finalized. However, trilogue negotiations between the Commission, Parliament, and Council on this extension collapsed in mid-March 2026, with the Parliament's lead negotiator criticizing the Council's "lack of flexibility."

The decisive moment came on March 26, 2026, when the European Parliament voted against extending the temporary derogation. With 311 MEPs voting against, 228 in favor, and 92 abstentions, the Parliament effectively ensured that the voluntary mass scanning of private messages would become illegal in the EU from April 4, 2026. This outcome was hailed by digital rights activists as a victory against mass surveillance, arguing it clears the way for more effective, targeted child protection. Conversely, some tech companies and child protection groups expressed concerns about a "legal vacuum" and a potential reduction in CSAM detection efforts.

As of March 27, 2026, the immediate consequence is the cessation of indiscriminate scanning of private messages by tech platforms in the EU. However, the broader fight continues, as trilogue negotiations for the permanent "Chat Control 2.0" regulation are still underway. The Parliament remains committed to a framework that protects children without undermining fundamental rights and end-to-end encryption, while the Council's position allows for voluntary scanning on non-encrypted services and focuses on risk-based obligations for platforms.