The European Parliament has approved the controversial measure widely known as "chat control," authorizing the scanning of private chats until 2028.

The vote clears the way for the automated review of private communications across the European Union under a framework that will remain operative for roughly the next four years. The measure has drawn its nickname, "chat control," from critics who argue it opens the door to mass surveillance of correspondence that users reasonably regard as confidential.

The deciding body is the European Parliament, the legislative branch of the Union directly elected by EU citizens. The 2028 endpoint written into the approved text means any scanning authority granted under the measure carries a built-in sunset horizon, requiring lawmakers to revisit or renew the framework before the deadline passes.

What the Decision Does

At its core, the approved measure permits the scanning of private chats — a category that covers messaging services used daily by hundreds of millions of Europeans. Until 2028, providers and authorities will operate under a legal basis that allows the content of private conversations to be examined rather than remaining shielded from review.

The Parliament's approval represents the culmination of a legislative fight that has divided EU institutions, member states, civil liberties organizations, and technology companies. Opponents have long warned that no technical architecture can scan private messages selectively; they contend that scanning, by its nature, must process all messages, encrypted or otherwise.

The Encryption Question

End-to-end encryption has stood at the center of the dispute. Providers of encrypted messaging services have argued that complying with scanning mandates would require breaking or circumventing the very protections that make their products secure. Security researchers have echoed that concern, cautioning that any mechanism built to scan encrypted traffic creates a vulnerability that malicious actors could exploit.

Supporters of the measure have framed it as a necessary tool in the fight against serious crime, particularly offenses involving the exploitation of children. That justification has driven the legislative initiative from its earliest stages.

The Parliament's decision does not end the argument. It settles, for now, the question of whether scanning of private chats may proceed at the EU level — and for how long. The answer, under the approved text, runs until 2028.

Practical Consequences for Practitioners

For lawyers advising technology platforms, telecommunications providers, and messaging services operating in the European Union, the approval brings a measure of certainty alongside significant compliance obligations. Counsel should prepare clients for scanning-related duties extending through 2028, assess how those duties interact with the General Data Protection Regulation and e-Privacy rules, and monitor implementing measures and any national transposition steps that follow. Privacy and data protection practitioners should also track likely litigation: civil society groups and privacy regulators may challenge aspects of the framework before the Court of Justice of the European Union, and the 2028 deadline itself creates a fixed point around which future legislative battles will be fought. Companies with encryption-dependent products face the most immediate strategic decisions about technical architecture and market exposure in the EU.

What Comes Next

The approval by the European Parliament marks a decisive step in the EU's legislative process. Implementation details, enforcement mechanisms, and the precise scope of scanning obligations will determine how the measure operates in practice between now and 2028.

What remains fixed is the core outcome: private chats in the European Union may be scanned under a legal framework the Parliament has now approved, and that authority carries an expiry date of 2028.