EU Extends Chat-Scanning Framework Until 2028, Excludes E2EE

The European Parliament has greenlit a temporary revival of controversial “chat scanning” rules that let online platforms voluntarily scan private communications for child sexual abuse material (CSAM) — but it carved out a crucial exception for end-to-end encrypted messages, a change that has grabbed attention across the crypto community. What happened - On July 9, Parliament voted to revive the temporary framework (sometimes dubbed “Chat Control 1.0”) that expired in April, extending voluntary scanning powers for platforms through 2028. - A bid to formally reject the Council’s position drew 314 votes in favor of rejection, 276 against and 17 abstentions — short of the absolute majority (361) required to block the measure. Because the rejection motion failed, the temporary framework moves forward. - Parliament simultaneously approved an amendment excluding communications protected by end-to-end encryption (E2EE). That amendment passed comfortably: 369 in favor, 236 against, 6 abstentions. What the rules do — and don’t do - The temporary rules permit online service providers to detect, remove and report suspected CSAM on a voluntary basis. Supporters say the framework gives platforms legal clarity to act against abuse. - Privacy advocates warned that broad scanning risks sweeping up innocent users’ private communications and increasing surveillance. - Crucially for security-conscious services, the Parliament’s amendment states the framework “should not cover communications to which end-to-end encryption is, has been or will be applied,” shielding E2EE-protected traffic from mandatory scanning under this temporary law. Why crypto stakeholders are alarmed - Wallets, recovery phrases, private keys and other sensitive on-device secrets rely on device-level security and encrypted channels. Blockchain groups and security experts have warned that client-side scanning — tools that inspect content on a user’s device before encryption — could expose seed phrases, session keys and other critical data. - The International Association for Trusted Blockchain Applications flagged new attack surfaces if scanning tools gain broad access to files on users’ devices, and raised concerns for open-source wallet and dApp developers who might face compliance burdens despite not controlling the underlying networks. - Ethereum co-founder Vitalik Buterin criticized the move before the vote, warning that lawmakers were attempting to “push Chat Control through again.” Political fallout and next steps - Pirate Party MEP Markéta Gregorová called the result “a bittersweet victory,” applauding the E2EE protection while lamenting that voluntary mass scanning passed. - The amended proposal now returns to the Council of the European Union. The Council can accept Parliament’s changes or reject them and reopen negotiations — meaning the final shape of the extension is still uncertain. - Separately, a broader permanent regulation often referred to as “Chat Control 2.0” remains under negotiation; talks are expected to resume in September. Key disputes linger, including whether detection should target specific suspected users or be applied broadly across services, and how to reconcile abuse-fighting measures with strong encryption. Bottom line for crypto users and developers For now, E2EE-protected communications have explicit protection from the current temporary scanning framework. But voluntary scanning and the threat of client-side inspection remain possible for unencrypted flows, and the debate over permanent rules continues. Crypto projects should watch the Council’s response and upcoming negotiations closely — the technical and security implications could be significant for wallets, key management and decentralized applications.