What the EU's July 2026 Chat Control vote actually changed

“Chat Control” is a nickname, not a law. It refers to a set of EU rules about whether and how online services may (or must) scan private messages for child sexual abuse material, known as CSAM. The debate matters because the same technology that scans for illegal images also decides how private your everyday conversations really are. Here is what the July 2026 vote did, and what it did not do, in plain language.

Two different things called “Chat Control”

It helps to separate two measures that often get merged in headlines.

Chat Control 1.0 is a temporary rule, first adopted in 2021, that allows certain messaging and email providers to voluntarily scan for CSAM. It is an exception to Europe’s ePrivacy rules, which otherwise protect the confidentiality of your communications. Because it is temporary, it has to be renewed periodically or it expires.

Chat Control 2.0 is the proposed permanent regulation, formally the Child Sexual Abuse Regulation (CSAR). This is the contentious one: earlier drafts included the possibility of mandatory scanning and so-called “detection orders” that could require services to inspect messages, potentially through client-side scanning, where content is checked on your own device before it is encrypted and sent.

The July 2026 vote was about the first of these.

What the vote changed

As of July 2026:

• The voluntary scanning regime (Chat Control 1.0) was extended to April 2028. Without an extension it would have lapsed, so this keeps the existing voluntary system running while the permanent law is still being negotiated.
• A majority of MEPs who voted actually voted against the extension. Under the applicable procedure, however, rejecting it required an absolute majority of 361 members, not just a majority of those present. That threshold was not met, so the extension stood.
• End-to-end encrypted services are excluded from the extended voluntary regime. In practice, a service that cannot read your messages cannot voluntarily scan their content either.

In short: nothing new was imposed on encrypted messaging, and no mandatory scanning was introduced by this vote. The existing voluntary arrangement was prolonged, against the wishes of a plurality of the Parliament, because of how the majority threshold works.

What is still open

The bigger question, Chat Control 2.0 / CSAR, remains in trilogue negotiations between the Parliament, the Council, and the Commission. Trilogues are the closed-door talks where the final text of an EU law is hammered out. The possibility of detection orders and client-side scanning is part of what is still being negotiated, and positions have shifted repeatedly. Because the outcome is not settled, treat any claim that “Chat Control is now law” or “encryption is now banned” with caution. As of July 2026, neither is true.

This is also why we date our claims. The situation is evolving, and a sentence that is accurate today may need updating after the next negotiating round.

Why proportionality, not the goal, is the debate

Protecting children from abuse is not in question. Nobody serious argues against the goal. The disagreement is about means: whether scanning everyone’s private messages, or weakening encryption to do so, is a proportionate and effective way to reach it, or whether it creates broad new surveillance capabilities and security risks while offenders move to tools outside the rules. That is a legitimate debate about method, and it is the one worth following closely.