The structural reason the EU's 'Chat Control' vote fell short

On July 9, the European Parliament's attempt to kill the EU's "Chat Control" proposal fell short, leaving in place a temporary legal carve-out that lets member states require messaging apps to scan message content on users' devices before encryption is applied. The vote's failure was not a narrow political miss. It was the predictable result of a five-year-old procedural track that has institutionalized that scanning without ever forcing a public fight over encryption.

"Chat Control" is the nickname for a long-running EU effort to mandate what the institutions themselves call "client-side scanning" or "upload moderation." Under the European Parliament's rules, the Parliament's Committee on Civil Liberties had sought to reject the Council's position extending the legal basis for that scanning regime. Rejection required at least 361 MEPs to vote in favor of the proposal, according to the public voting record at HowTheyVote.eu. The Register, covering the vote, framed the outcome as the "snoopfest" returning: the proposal survives, and the next procedural steps now run through the Council.

To see why a rejection was always unlikely, follow the regulations rather than the headlines. In July 2021, the EU adopted Regulation 2021/1232, a temporary derogation from the ePrivacy Directive (2002/58/EC) that allowed number-independent interpersonal communications services (messaging apps) to process personal data to combat online child sexual abuse. That carve-out became the legal hook for client-side scanning. In April 2024, the EU extended and reshaped the framework with Regulation 2024/1307, keeping the ePrivacy exemption alive on a renewed timeline.

That pair of regulations is the mechanism that makes the procedural fight largely symbolic. Rather than amending the ePrivacy Directive or reopening the encryption debate directly, member states who want scanning have a parallel track: extend the temporary derogation, attach scanning mandates to it, and force the Parliament to muster a supermajority to reject the whole package. The 361-MEP threshold for rejection is set high, so the burden of proof falls on those who would block the derogation, not on those who would extend it.

The voting record on HowTheyVote.eu makes the coalition math visible. The European People's Party (EPP) heavyweights, including Aaltola (Finland), Abadía Jover (Spain), Adamowicz (Poland), and Agius (Malta), voted against rejection. Renew Europe split: Agirregoitia Martínez (Spain) voted for rejection, while Al-Sahlani (Sweden) and Allione (France) voted against. The European Conservatives and Reformists (ECR) also broke across the aisle, with Alexandraki (Greece) voting for rejection. That fragmentation, a center-right bloc opposed to rejection with pro-rejection votes scattered across Renew, the ECR, and the left, is the structural reason the threshold was not cleared.

The technical and civil-society critique that has animated the fight since 2021 is consistent. Security researchers and digital rights organizations have long argued that once a client sees plaintext before encryption is applied, end-to-end encryption's threat model changes regardless of how the scanning is implemented. The Register's framing of the vote as the "snoopfest" returning rests on that critique: the legal window for scanning stays open, and the political effort to close it just lost another round.

For readers outside the EU, the stakes are not abstract. Any platform that operates in the EU market, including end-to-end-encrypted messaging services, would have to implement the scanning under the proposal, and operational design choices the EU mandates tend to become the de facto global baseline for security products. The next pressure point is the Council's response to the Parliament's failed rejection. If the Council re-adopts its position, the file moves toward the next stage of the ordinary legislative procedure, and the derogation remains live through its current extension window.