EU Parliament Votes to End Untargeted Mass Scanning of Private Messages in Historic Chat Control Decision
The European Parliament voted 458 to 103 on March 11 to restrict scanning of private communications to judicially authorized, targeted investigations, rejecting years of pressure for blanket surveillance of encrypted messaging platforms.
Overview
The European Parliament voted on March 11 to end untargeted mass scanning of private messages across the bloc, marking a decisive turn in one of Europe’s most contentious digital rights debates. By a margin of 458 to 103, with 63 abstentions, MEPs adopted Amendment 5 requiring that any scanning of private communications be strictly limited to individual users or groups suspected by a competent judicial authority of involvement in child sexual abuse. The vote effectively rejects proposals that would have allowed platforms to scan all private conversations without prior suspicion.
The decision came as part of a broader vote to extend the temporary exemption to EU privacy rules, known informally as Chat Control 1.0, which has since 2021 permitted online service providers to voluntarily detect and report child sexual abuse material. That exemption, originally set to expire on April 3, was extended until August 3, 2027, to provide time for negotiations on a permanent regulatory framework.
What We Know
The key change is Amendment 5, tabled by Pirate Party MEP Markéta Gregorová of the Greens/EFA group and adopted by a narrow margin. The amendment demands that any scanning of private communications must target only users or groups identified by a judicial authority as suspects, rather than sweeping entire platforms. According to the Parliament’s position, voluntary detection measures “need to remain proportional and targeted and should not apply to end-to-end encrypted communications.”
Rapporteur Birgit Sippel of the Socialists and Democrats group framed the decision as a balance between competing imperatives, stating that lawmakers have “a responsibility to address the horrific crime of child sexual abuse while safeguarding everyone’s fundamental rights.” Sippel emphasized that the framework preserves end-to-end encryption while creating a proportionate system that can withstand judicial scrutiny.
The debate has been shaped by troubling data about the existing voluntary scanning regime. According to digital rights advocate Patrick Breyer, 99 percent of existing chat reports come from Meta alone, nearly half of disclosed chats are false positives, and 40 percent of resulting German investigations have targeted minors rather than predators. Chat reports have also dropped 50 percent since 2022 as more platforms adopted end-to-end encryption, raising questions about the effectiveness of mass scanning as a child protection tool.
The Electronic Frontier Foundation has warned that even the Council’s November 2025 negotiating position, which removed mandatory scanning requirements for encrypted services, contains ambiguous language on client-side scanning that could indirectly pressure providers toward surveillance measures. The EFF has called for “clear and unambiguous language” to prevent authorities from taking a hostile view of encryption protections.
What We Don’t Know
The Parliament’s vote establishes its negotiating position, but the final shape of the regulation depends on trilogue negotiations between Parliament, the Commission, and the Council. According to Breyer, a third trilogue is scheduled for May 4, with a fourth and presumably final round on June 29. Formal adoption, if political agreement is reached, is expected in July.
The EU Commission and the vast majority of the EU Council, with Italy as the sole exception, have so far categorically rejected restrictions on untargeted mass scanning. Whether the Council will accept the Parliament’s insistence on judicial authorization remains the central open question. Several member states, including Spain and Ireland, have historically pushed for broader scanning powers, while Germany, Austria, and the Netherlands have sided with privacy advocates.
Age verification mandates in the Council’s position could also reshape private communication access in ways that are not yet fully understood. The EFF has raised concerns that risk mitigation obligations may function as indirect pressure on providers to implement surveillance measures, even if the final text nominally protects encryption.
Analysis
The March 11 vote represents the Parliament’s strongest statement yet on the limits of digital surveillance in the name of child protection. For more than three years, the Chat Control debate has tested whether the EU would require technology companies to build scanning systems capable of reading private messages, a capability that cryptographers and technologists have consistently warned would undermine encryption for all users, not only those under investigation.
The vote’s lopsided margin of 458 to 103 suggests broad cross-party consensus that blanket scanning is disproportionate, even among groups that support aggressive child safety measures. The European People’s Party, initially resistant to restrictions, ultimately joined the compromise. That political alignment gives Parliament a strong hand in trilogue negotiations, though the Council’s history of pushing for expansive scanning powers means the final regulation could still diverge significantly from the Parliament’s position.
The extension to August 2027 creates a longer runway for negotiations but also means the current voluntary regime, with its documented false positive rates and disproportionate impact on minors, will remain in place for at least another year.