More members of the European Parliament voted to kill Chat Control 1.0 than to keep it. The law survived anyway. That sentence tells you almost everything you need to know about what happened in Brussels on July 9, 2026.
In a vote that will frustrate privacy advocates for years, 314 MEPs rejected the extension of the temporary derogation known as Chat Control 1.0, while 276 voted in favor, with 17 abstentions. By any intuitive reading of democracy, opposition won. But the second-reading procedure required an absolute majority of 361 votes to formally block the extension, a threshold the opposition fell short of. The result: voluntary scanning of private messages by digital platforms continues until 2028, or until permanent legislation arrives, whichever comes first.
How a majority loss became a legal victory
Under the second-reading rules that applied here, blocking the extension required not just more “no” votes than “yes” votes, but an outright absolute majority of the full chamber. The procedural gap matters because it represents a meaningful shift from how earlier Chat Control votes were conducted, where a simple majority was sufficient.
An amendment that would have narrowed the scope of scanning to individuals already under judicial suspicion received 322 votes in favor, more support than the extension itself attracted. That amendment also failed to clear the absolute majority bar.
The derogation being extended traces back to 2021, when the EU carved out a temporary exception to its ePrivacy Directive. That exception let digital platforms voluntarily scan messages for known child sexual abuse material, for previously unseen CSAM generated through AI detection, and for grooming behavior. The original Chat Control 1.0 extension was set to expire in April 2026. Parliament rejected it in March of that year, forcing the current legislative scramble. The two-year runway now established gives EU institutions time to finalize a permanent successor regulation. Negotiations for what critics have labeled Chat Control 2.0 are expected to resume in September 2026.
What Chat Control actually does, and why privacy advocates are alarmed
The “voluntary” label in Chat Control 1.0 is doing a lot of heavy lifting. Platforms are not legally compelled to scan, but the regulatory environment creates strong incentives to do so. For encrypted messaging platforms, this creates a structural problem. End-to-end encryption means that even the service provider cannot read the message content. Scanning for CSAM requires either breaking that encryption, scanning before encryption occurs on the device, or implementing client-side scanning. The symbolic carve-out for encrypted communications included in this extension does not resolve that technical tension.
That permanent regulation is where the higher-stakes fight will happen. Chat Control 1.0 covers voluntary scanning by willing platforms. A mandatory permanent regulation would represent a fundamentally different level of state involvement in private communications across the bloc’s roughly 450 million residents.
What this means for crypto, privacy tech, and digital markets
The most direct market impact lands on encrypted communication platforms and the companies behind them. Signal, Threema, and similar services have previously threatened to exit EU markets rather than compromise their encryption architecture. The extension of Chat Control 1.0 does not legally compel them to do anything new, but it extends the regulatory uncertainty that makes long-term product planning difficult in Europe.
For investors with exposure to European tech infrastructure, the more immediate question is what compliance costs look like if a mandatory scanning regime eventually passes. Building CSAM detection into a communication platform is not trivial engineering, and for smaller startups it could represent a meaningful barrier to operating in the EU market, concentrating the space among larger incumbents who can absorb the overhead.