More MEPs voted against renewing Chat Control than for it, yet a second-reading rule let it pass, and the fine print reveals that “voluntary” means voluntary for Google and Meta, never for you, with no way to opt out. Scanning was never really a choice made by governments or citizens; it is switched on across the whole bloc by a handful of platforms operating above the state, laying the exact infrastructure a mandatory Chat Control 2.0 would ride straight into.
When the majority loses the vote
On Thursday 9 July 2026, more members of the European Parliament voted against renewing Chat Control than voted for it. 314 said no, 276 said yes, 17 abstained. The regulation passed anyway. The story lives in two places: how a rejected law came back to life, and in a single word doing a great deal of quiet work. Voluntary.
How a rejected idea came back
Chat Control 1.0 is the informal name for a temporary exemption to the EU’s ePrivacy rules. It lets companies such as Google, Meta and Microsoft scan private messages and emails for child sexual abuse material (CSAM). Parliament refused to extend it in March, and the exemption lapsed on 3 April. For three months, that appeared to be the end of it.
Then came the sleight of hand. On Tuesday 7 July, using a rarely invoked urgency procedure, Parliament’s leadership put the question back on the agenda by 331 votes to 304. The timing did the heavy lifting. The follow-up vote took place on 9 July, the final sitting before the summer recess, by which time many MEPs had already left Strasbourg. Because the file was now in its second reading, blocking it required an absolute majority of the 720 members (ie 361 votes), rather than a majority of those present. Opponents outnumbered supporters and still fell short of that threshold. Chat Control 1.0 now runs until April 2028.
Markéta Gregorová, one of the Greens negotiating on the file, warned from the floor that the process broke Parliament’s own rules. Former MEP Patrick Breyer, who has tracked this fight since 2021, called it a farce that damages democracy. Their objection was less about the content than the method: a proposal already voted out was reintroduced on a schedule that structurally favoured the side pushing it.
What “voluntary” actually means
The word doing the quiet work is voluntary, and the question is who the volunteering belongs to. It is not you. Chat Control 1.0 permits providers to scan, though it does not require them to. The choice rests with the platform, not the citizen, and the citizen is given no way to decline, even though it’s “voluntary.”
In practice, this means it targets all large-scale unencrypted services: direct messages on Instagram, Messenger, Snapchat and Xbox, and emails on Gmail and iCloud. The tool uses hash matching, which compares your files against a database of already-identified CSAM images. Google, Meta, Microsoft and Snap opted in to this back in 2021 and never stopped. During the three months this year when the legal basis had lapsed, they carried on scanning anyway, without a law behind them and without consequence.
The national angle of “voluntary” that Chat Control 1.0 alludes to collapses here. A member state’s position barely matters once the transnational platform its people actually use has switched scanning on for everyone. These companies operate above any single government, across the whole bloc at once. So a rule that looks optional at the level of Brussels becomes compulsory at the level of the individual, because the individual was never offered the choice in the first place. The most you can do, once your private messages have already been read, is lodge a complaint with a data protection authority.
The numbers behind the mission
No one argues against protecting children. The question is whether this method achieves it, and the evidence gathered around the vote is not flattering.
Roughly 99 per cent of the reports Meta generates in the EU concern material already known to investigators, which means the system mostly recycles old findings rather than surfacing new abuse. Around 48 per cent of its alerts were flagged as not criminally relevant. In one telling figure, about 40 per cent of the resulting investigations targeted minors themselves, often teenagers caught up in images of their own lives. For unknown material, the Commission’s own report found false positive rates between 13 and 20 per cent. Scaled across billions of daily messages, even a small error rate produces millions of wrongly flagged conversations.
A system that floods investigators with noise while missing the sophisticated actors who already operate on encrypted channels is not the tool it’s advertised to be. It is a net cast over everyone, catching mostly the innocent.
The rails for what comes next
Chat Control 1.0 is more of a Trojan Horse under the guise of protection. Every “temporary” extension and every “voluntary” scan normalises the practice of reading the messages of people suspected of nothing, and builds the machinery that a mandatory version would ride straight into.
That mandatory version is branded Chat Control 2.0 (officially the Child Sexual Abuse Regulation). It would remove the voluntary choice, compel scanning across all providers, and reach into encrypted messages through client-side scanning, meaning your own device would inspect what you write before it is ever sent. The direction of travel is already visible in the smaller moves. Meta removed end-to-end encryption from Instagram messages in May, which turned a protected surface into a scannable one.
Even the institutions have noticed. The Council’s own legal service warned in June that the permanent 2.0 proposal likely breaches Article 7 of the EU Charter, the right to respect for private life and communications. Signal has said it would leave the European market rather than build a back door into its encryption. Negotiations on the permanent law resume in September, and the scaffolding raised by the “voluntary” regime will still be ready when they do.
Why this reaches further than a screen
A private message is a small act of trust. You write differently when you believe no one else is reading. Something in the mind loosens, tells the truth, tries out a half-formed thought it would never risk in a room full of strangers. Remove the certainty of privacy and that freedom stops. This is not about people hiding things. Under this style of regime, they think less freely, self-edit earlier, and slowly forget what an unobserved thought felt like.
This is why the sovereignty of private communication is more than a technical footnote. The inner life needs somewhere to speak before it is ready to be judged. A culture that scans by default, however noble the stated reason, trains its people toward a quieter, more careful, more governable interior. The most consequential surveillance is the kind we begin to perform on ourselves.
An idea can be rejected repeatedly and still return, reshaped, rescheduled, waiting for the moment when fewer people are watching. Freedom is rarely lost in a single dramatic vote. It erodes through procedure, through fatigue, through the quiet assumption that someone else is paying attention. Staying awake to how these decisions are actually made, and refusing to look away when the mechanics turn boring, may be the most practical form of sovereignty a free mind still has.
Join the Conversation
Do you experience the renewal of Chat Control as a real effort to protect the vulnerable, or as one more step toward a watched and self-editing public? And where in your own life do you notice the difference between how you think in private and how you speak when you sense you are being observed? Share your experiences and insights below.
