The European Parliament failed on Thursday afternoon, July 9, 2026, to block the extension of Regulation (EU) 2021/1232 — the so-called Chat Control 1.0 derogation — and the measure passed into law by default. Of 607 MEPs voting in Strasbourg, 314 voted to reject the text: a clear majority of those voting, but 47 votes short of the 361-vote absolute majority of all 720 members required to stop a Council second-reading position. Voluntary mass scanning of private messages on platforms including Gmail, Snapchat, Facebook Messenger, and Skype is now lawful across the EU until April 3, 2028.

A Law Rejected Twice Now Stands

The regulation, first adopted in 2021, created a temporary exception to the ePrivacy Directive allowing platforms to voluntarily scan private communications for child sexual abuse material (CSAM). Google, Meta, and Microsoft opted in immediately.

On March 26, 2026, Parliament voted down an extension: 311 opposed, 228 in favour, 92 abstained. The derogation expired on April 3. That appeared to end the matter.

On July 2, 90 days after Parliament's rejection, the Council of the EU adopted the Commission's original text as its official second-reading position. That single step transformed the arithmetic. Under Article 294 TFEU and Parliament's second-reading rules, Parliament can reject or amend a Council second-reading position only by an absolute majority of all members — 361 of 720 — not a majority of those voting. Absences and abstentions effectively count as support for the Council's text.

On July 7, the European People's Party (EPP), the Parliament's largest group, moved under Rule 170 of the Rules of Procedure to invoke an urgency procedure, bypassing committee review and sending the proposal directly to a plenary vote before the summer recess. Parliament President Roberta Metsola, an EPP member, initiated the process. The urgency vote passed 331 to 304.

"This is unprecedented," said Greens/EFA MEP Markéta Gregorová, the Parliament's negotiator on the file. "This is no longer just about protecting privacy — it is about protecting our democracy."

What the Law Permits

Chat Control 1.0 authorizes but does not require platforms to scan private messages using three methods: perceptual hash-matching against databases of known CSAM maintained by organizations such as NCMEC and the Internet Watch Foundation; AI-based classification of previously unseen material; and text analysis for grooming-pattern detection.

The regulation does not apply to end-to-end encrypted communications — and never did. An amendment explicitly exempting E2EE services was adopted alongside the main vote. According to former MEP Patrick Breyer's post-vote analysis, the platforms covered are unencrypted or server-side-encrypted US services: Gmail, Facebook Messenger (pre-2023), Instagram DMs (post-May 2026, after Meta removed E2E encryption), Skype, Snapchat, iCloud Mail, and Xbox. WhatsApp, Signal, and iMessage (with iCloud backup disabled) remain outside its scope.

The accuracy record is contested. The European Commission's own implementation report found AI-based classifiers produced a false positive rate "as high as 20 percent." Germany's Federal Criminal Police Office (BKA) reported that 48 percent of Chat Control intelligence alerts are "not criminally relevant." Breyer, citing the same data, noted that 40 percent of investigations triggered by flags target minors themselves, and that an estimated 99 percent of Meta's reports consist of previously known material.

Litigation Pathway Opens

Article 7 of the EU Charter of Fundamental Rights guarantees respect for private communications. The Council's own Legal Service issued an opinion — later leaked — stating the regulation as written is incompatible with Article 7. That finding underpins what observers expect will be a challenge before the Court of Justice of the European Union. The European Court of Human Rights ruled in a 2024 case involving Russia's SORM surveillance law that requiring degraded end-to-end encryption "cannot be regarded as necessary in a democratic society" — persuasive, though not binding, authority for the CJEU.

Prof. Bart Preneel of KU Leuven and Prof. Carmela Troncoso of the Max Planck Institute co-authored an appeal to MEPs urging a no vote on the urgency procedure, warning that available detection technologies exhibit "unacceptably high error rates." They applied to a user base of 450 million EU citizens communicating daily.

A Procedural Template

The mechanism is not specific to this legislation. Any proposal Parliament fails to reject by absolute majority at second reading is deemed adopted — a rule intended to give negotiated trilogue texts the benefit of the doubt. Here, the Council adopted its position not after trilogue but precisely to trigger the second-reading arithmetic after Parliament's first-reading rejection.

"The EU Parliament REJECTED Chat Control, but now they are forcing us to vote on the same issue over and over until they get the result they want," MEP Fidias Panayiotou wrote Thursday. "What kind of democracy is this?"

Breyer was blunter: "The fact that Chat Control is moving forward against the will of the majority of voting MEPs is a farce and damages democracy."

EPP leader Manfred Weber and four European Commissioners offered a different framing ahead of the vote, arguing that disrupting detection "seriously weakens our collective ability to identify abuse, support victims, and stop offenders." The EPP had opposed the March extension because of Socialist rapporteur amendments restricting its scope; the second-reading route restored the Commission's original text.

The E2EE Amendment and Next Steps

Parliament's adopted E2EE-exemption amendment must now return to the Council, which has until approximately October 9, 2026, to accept or reject it. Rejection would trigger a Conciliation Committee. The core scanning authorization is already in force.

The permanent Child Sexual Abuse Regulation (Chat Control 2.0) remains under negotiation after five failed trilogue rounds — the fifth collapsing on June 29, 2026, over suspicionless scanning. A sixth round is expected under the Irish Presidency in September. Breyer argued the restoration of 1.0 removed the Council's incentive to compromise: "The Council will never agree to a desperately needed paradigm shift as long as they can simply stick to the old approach of suspicionless scanning at the whim of the tech industry."

For practitioners, three implications follow. First, platforms scanning under the restored derogation regain legal basis retroactively to the lapse period; users who believe they were scanned illegally between April 3 and July 9 can complain to national data protection authorities under Article 5 of the ePrivacy Directive. Second, a CJEU challenge — potentially initiated by organizations with standing, such as GFF (Gesellschaft für Freiheitsrechte) — could invalidate the derogation notwithstanding its passage. Third, the absolute-majority arithmetic of Article 294(7) TFEU second readings now stands demonstrated as a route to revive legislation Parliament has rejected at first reading — a precedent relevant to any file where the Council prefers the Commission's original text.