A Vote Against the Measure That Still Became Law
On July 9, 2026, 314 members of the European Parliament voted against Chat Control. In most legislative systems, that would be enough to sink a proposal. Instead, the measure passed anyway, a result of a procedural voting threshold that required something other than a simple majority of votes cast to block it.
The outcome is jarring on its face: more MEPs opposed the measure than supported it, yet it moved forward. This wasn't a case of Parliament changing its mind about mass message scanning. It was a case of parliamentary mechanics producing a result that doesn't match the raw vote count, and it has reignited scrutiny of how the EU's long-running scanning framework keeps resurfacing even when lawmakers appear divided against it.
This latest vote follows a pattern that's become familiar to anyone tracking this legislation. As covered in our report on how the EU Parliament renewed the Chat Control scanning law on July 9, the regulatory regime permitting companies to scan private messages for child sexual abuse material was extended on the same date, continuing a legal basis that had technically expired earlier in the year.
Why the Legal Basis Needed Reviving in the First Place
The rule at the center of this vote isn't new. It's a revival. The original legal basis for message scanning technically expired on April 4, 2026, and MEPs voted in July to restore it, as detailed in our coverage of how the EU revived Chat Control 1.0 in a surprise July vote. That timeline matters because it shows the framework isn't operating on a stable, continuously renewed footing. It has lapsed and been reinstated, debated and re-debated, across multiple sessions over the past year.
This back-and-forth is part of why the July 9 vote drew so much attention. A measure that a majority of MEPs voted against still cleared the bar because the applicable threshold wasn't a simple majority of votes cast. The specifics of Chat Control, often described using the umbrella term for the EU's push to scan private communications for CSAM, are explained in more depth in our breakdown of what the Chat Control CSAM scanning plan actually involves. The core mechanism under discussion is client-side scanning: software that would examine message content on a user's own device before encryption is applied, rather than intercepting data in transit or on a server.
What This Means for Encryption and Crypto
Client-side scanning sits at an uncomfortable intersection with end-to-end encryption. Encrypted messaging apps promise that only the sender and recipient can read a message's content. Client-side scanning technically works around that promise by inspecting content before it's encrypted or after it's decrypted, on the device itself, rather than breaking the encryption in transit. Critics argue this still amounts to building a scanning capability into private communications, one that could be expanded, misused, or targeted by bad actors who find ways to exploit the same scanning infrastructure.
For cryptography and privacy-focused technology companies, the stakes go beyond messaging apps. Any mandate that requires scanning infrastructure on devices raises questions about how that infrastructure interacts with other encrypted tools, including wallets, secure communications, and privacy software built on similar cryptographic foundations. Privacy providers have been vocal participants in this debate. Our coverage of Proton's response amid the EU Chat Control debate outlines how encrypted service providers have pushed back on scanning mandates while still engaging with the underlying goal of combating child exploitation online.
What This Means For You
If you use encrypted messaging, VPNs, or privacy-focused tools within the EU, this vote doesn't change your day-to-day experience immediately. Chat Control has not resulted in scanning being deployed across every messaging app overnight. But the legal groundwork for that possibility keeps getting reinforced, vote after vote, even when a majority of lawmakers object.
The practical takeaway is that this is an ongoing regulatory fight, not a settled one. The framework has expired and been revived before, and procedural quirks have allowed it to advance even against majority opposition. That instability means the rules governing private communication in the EU could shift again with little warning.
Staying Informed and Taking Action
A few concrete steps worth considering: follow how individual messaging and privacy providers respond to scanning mandates, since their public statements often signal how implementation might actually work in practice. Pay attention to whether any client-side scanning requirement includes exemptions for encrypted services, since that detail determines how directly it affects tools you already use. And recognize that legislative outcomes in this area don't always track the headline vote count, so it's worth reading past the topline numbers before assuming a measure has been rejected or confirmed for good.
Chat Control remains one of the more consequential ongoing debates over encryption and digital privacy in Europe, and this vote is unlikely to be the final word.
