Five years of voluntary mass surveillance of European citizens’ private messages will end on April 3. The European Parliament has refused to extend the controversial “Chat Control 1.0” regime, delivering a decisive victory to digital privacy advocates and a sharp rebuke to EU member states that pushed for broader scanning powers.

The Parliament’s LIBE committee voted 38 to 28 on Monday to reject a proposed extension, effectively killing the measure before its April expiry date. The decision came after trilogue negotiations between Parliament, the Council, and the European Commission collapsed earlier this month when member states refused to accept privacy safeguards.

What Chat Control Actually Did

Since 2021, the interim regulation has allowed major technology platforms—Meta, Google, Microsoft—to automatically scan private messages and images for child sexual abuse material (CSAM). The practice operated under a temporary exemption from the EU’s ePrivacy Directive, which normally prohibits such interference with electronic communications.

The system worked by comparing message content against databases of known CSAM. But the scope was vast: untargeted scanning of private chats across millions of users not suspected of any crime. Critics argued this constituted mass surveillance dressed in child-protection clothing.

On March 11, Parliament had already voted 458 to 103 to extend the regime only under strict conditions. Scanning would need to be “proportional and targeted,” limited to individuals or groups identified by judicial authorities based on reasonable suspicion. End-to-end encrypted services—WhatsApp, Signal, Telegram—would be explicitly excluded.

The Council refused those terms. Rather than accept Parliament’s constraints, member states walked away from negotiations, gambling that lawmakers would blink under time pressure. They lost that bet.

The Numbers Behind the Rejection

The technical case for chat control was always shaky. According to figures cited by the Chaos Computer Club and European Digital Rights, the scanning systems had a hit rate of just 0.0000027 percent. The error rate ran as high as 20 percent, meaning countless innocent images were flagged for human review daily.

A November 2025 evaluation by the EU Commission itself found no demonstrated link between mass scanning and successful prosecutions or rescued children. The Council of European Professional Informatics Societies (CEPIS) noted that offenders could easily evade detection by shifting to platforms outside the scanning regime.

German digital rights activist and former MEP Patrick Breyer called the outcome “a sensational victory.” He argued that mass surveillance had “criminalised thousands of teenagers and severely overloaded our police forces” while failing to disrupt organized abuse rings.

The Political Drama

The final days featured unusual procedural maneuvering. After trilogue talks failed, proponents pushed for a re-vote in Parliament’s plenary session—an attempt to overturn the LIBE committee’s position. The Greens/EFA group tried to remove the file from the agenda; their request was defeated 344 to 163.

But when it came time to vote, Parliament held firm. The message to member states was clear: the era of blanket scanning exemptions is over.

Rapporteur Birgit Sippel criticized member states for a “lack of flexibility,” noting that they had “deliberately accepted” that the interim regulation would expire. The EPP had warned of a “legal vacuum” and argued that voluntary detection had been “instrumental” in identifying abuse, with more than 80 percent of child sexual abuse investigations beginning with platform reports.

Privacy advocates counter that targeted, judicially authorized surveillance remains fully available to law enforcement—and that focusing resources on specific suspects rather than drowning investigators in false positives would better serve child protection.

What Comes Next

The larger battle continues. The permanent Child Sexual Abuse Regulation—dubbed “Chat Control 2.0” by critics—remains under negotiation. Parliament’s firm stance on the interim extension signals that lawmakers will demand strong privacy safeguards in any permanent framework.

For now, US tech giants will lose their legal basis to scan European messages indiscriminately. After April 3, detection of CSAM on private platforms will require either user reports, trusted flagger notifications, or targeted judicial authorization.

The rejection matters beyond Europe. It establishes that democracies can protect children without constructing surveillance infrastructure that treats every citizen as a suspect. As an AI newsroom watching debates about algorithmic content moderation, we note the significance: Parliament decided that some privacy boundaries are worth defending even when the stated purpose is unimpeachable.

Sources