EU Extends Chat Control Scanning Rule to 2028

The EU's on-again, off-again fight over message scanning has taken another turn. Member states approved a temporary Chat Control derogation in early August, restoring voluntary CSAM (child sexual abuse material) scanning of private messages until April 2028. The catch: this happened after a European Parliament vote where more MEPs actually voted to reject the measure than to keep it.

If that sounds contradictory, it's because EU lawmaking often is. Understanding how this extension came about, and what it means for anyone who uses messaging apps in Europe, requires untangling a process that moved forward even as elected representatives pushed back.

Chat Control's Extension: What Happened

The derogation at the center of this story allows messaging providers to voluntarily scan private communications for CSAM, a practice that has been legally contested for years because of its implications for end-to-end encryption and general privacy. Rather than letting the temporary rule lapse, EU member states voted to renew it, pushing the expiration date out to April 2028.

This is not the first time this specific mechanism has been extended. The voluntary scanning derogation has existed in some form since 2021, repeatedly renewed as a stopgap while a more permanent Chat Control regulation remains stuck in negotiation. Each renewal keeps the door open for platforms to scan messages, even as the broader legislative debate about mandatory scanning continues unresolved.

The Parliament Vote Paradox

What makes this round notable is the disconnect between the Parliament vote and the outcome. According to reporting, more MEPs voted to reject the scanning derogation than voted to keep it. Yet the measure moved forward anyway, approved by member states through the EU's layered legislative process.

This outcome underscores a structural reality of EU policymaking: Parliament's vote on a measure like this does not always function as a simple yes-or-no veto. Depending on the legislative vehicle used, member states acting through the Council can still approve extensions even when Parliament's sentiment leans against them. For privacy advocates who have spent years opposing Chat Control, the vote count offered a moment of validation that ultimately did not translate into a blocked policy.

The result is that voluntary scanning remains legally available to platforms operating in the EU for nearly three more years, even though a majority of voting MEPs signaled they wanted it gone.

The AI Act's Quiet Compliance Date

Chat Control wasn't the only major EU policy story in early August. 2 August was widely expected to be the EU AI Act's biggest compliance milestone, a date many businesses and regulators had been preparing for. But by most accounts, the date came and largely went without the sweeping enforcement moment many anticipated.

This pattern, big legislative deadlines arriving with limited immediate impact, is becoming familiar in EU tech regulation. It doesn't mean the rules don't matter; it means implementation is often gradual, uneven, and dependent on how member states and companies interpret their obligations over time. The same incremental approach shows up in how surveillance-adjacent technology gets deployed more broadly. Just as license plate tracking systems have expanded quietly at the state level, as seen in how North Carolina's budget lets its State Bureau of Investigation track drivers via AI license plate cameras, EU-level rules around scanning and AI oversight tend to advance through incremental extensions and soft compliance dates rather than dramatic single-day changes.

What This Means For You

If you use messaging apps that operate in the EU, the practical effect of this extension is that voluntary CSAM scanning remains a legal option for providers through April 2028. Whether any specific app you use actually performs this scanning depends on that provider's own policies, but the legal framework permitting it isn't going anywhere soon.

For privacy-conscious users, this is a reminder that legislative debates over encryption and scanning rarely end with a clean resolution. Chat Control has been extended, revised, and renegotiated repeatedly since 2021, and this latest extension suggests that pattern will continue rather than resolve into permanent legislation anytime soon.

Actionable Takeaways

Stay informed about which messaging platforms you use and whether they participate in voluntary scanning programs, since this varies by provider. If message privacy is a priority, look into apps that offer end-to-end encryption by default and publish transparency reports about their scanning practices. Keep an eye on future Parliament votes and Council decisions, since the gap between MEP sentiment and final outcomes shown in this vote suggests the fight over Chat Control is far from settled. And recognize that EU tech regulation, whether it's about message scanning or AI oversight, tends to move through extensions and incremental deadlines rather than sudden, sweeping change, so ongoing attention matters more than reacting to any single headline.