‘Chat control’ surveillance program extended by European Parliament to 2028

Opponents of the bill have warned the measure prolongs mass surveillance powers while paving the way for mandatory monitoring of digital communications across the EU.

STRASBOURG, France (LifeSiteNews) — The European Parliament has extended its “Chat Control” legislation, a private messaging surveillance program billed as a tool against child sexual abuse material, until April 2028 after a procedural maneuver let the measure pass despite a majority of lawmakers voting against it. On July 9, the European Parliament adopted an extension of Chat Control 1.0, a temporary and voluntary exemption from privacy rules in the EU, purportedly aimed at detecting online child sexual abuse material.

The regulation will now remain in force until April 3, 2028, giving EU institutions additional time to negotiate a proposed successor framework. Commonly known as Chat Control 2.0, the proposed legislation would make screening of private messages and photos mandatory, including on encrypted services like WhatsApp and Signal. The extension of Chat Control 1.0 advanced after a procedural sequence that prevented a direct vote on the merits of the legislation itself.

“It’s a disgrace that the Chat Control instrument has passed in the European Parliament,” said Svenja Hahn, president of the ALDE Party and a German Member of the European Parliament, in comments to EUTechLoop. “It opens the door for mass surveillance of all private communication of our European citizens instead of the targeted fight against child sexual abuse as proposed by the Parliament. The surveillance of private chats pushed by EU-states is a threat for our freedom and democracy.

We need to continue fighting against Chat Control.” At the core of Chat Control 1.0 lies Regulation (EU) 2021/1232 which allows a temporary derogation from EU privacy laws for providers to use automated systems to detect child sexual abuse material. This derogation expired on April 3 of this year, but discussions to extend it stalled due to the opposition of several organizations that expressed concern about the humanitarian implications of the proposed regulation.

As reported by EuroNews, Members of the European Parliament rejected a proposal in March to prolong Chat Control 1.0 after negotiations failed to produce an agreement. An amendment passed requiring that monitoring be restricted to individual users or groups already under suspicion by order of a judicial authority, thereby preventing indiscriminate access to the correspondence of EU-based private communications. Later, in June, European Parliament President Roberta Metsola re-opened the legislative file for consideration by the European Council, calling for the EU to “find an agreement on a second reading of this file.”

On July 2, the council therefore presented as its “own initiative” the very amended proposal that had just been rejected by Parliament, forcing a second reading, namely a new round of debate and voting. Since the proposal became the European Council’s “official position,” the rules of the European Parliament require an absolute majority – not of those present, but of all MEPs – to amend it. This made it considerably harder for opponents to overturn the bill.

On July 9, during the debate, a first vote showed a simple majority in favor of rejecting the council’s position. A second vote was then held, but it failed to reach the absolute majority needed to overturn the amended text. As a result, the proposal was not rejected.

The law was therefore approved, and Chat Control 1.0 has been extended until April 3, 2028. However, the amended version of Chat Control 1.0 introduced a clause excluding end‐to‐end encrypted communications (for example, on WhatsApp and Signal) from the regulation’s reach, regardless of whether they are encrypted now, were in the past, or will be in the future. Also, email services such as Gmail and iCloud, cloud storage protected by server‐side encryption, and unencrypted direct messaging on Instagram and Facebook remain “exposed and strongly incentivized to carry out voluntary scanning.”

As journalist Maurizio Milano reported, before the April 2026 suspension, the Meta collection of platforms alone accounted for almost all the reports sent to European law‐enforcement authorities. From autumn 2026, work will begin on the permanent version 2.0, which will introduce “mandatory, pre‐emptive” monitoring directly on the devices used by all EU citizens. The new framework is expected to be approved by July 2028 and to include so‐called client‐side scanning.

To achieve this, an algorithm is installed directly on the user’s phone or computer which analyses content as it is being typed, before it is encrypted and sent.