Context

On 9 July 2026, the European Parliament took an important step towards allowing Chat Control 1.0 to come back into force. Since 2021, this regulation had allowed certain providers to voluntarily analyse private communications in order to detect child sexual abuse material and potential grooming behaviour.

Chat Control 1.0 expired on 3 April 2026 because a new extension was not approved in time and, from that point onwards, the European exception covering these activities ceased to exist. The intention now is to reinstate it and keep it in place until 3 April 2028.

The regulation was introduced as a temporary solution while the European Union prepared permanent legislation. However, if this new extension is ultimately approved, an exception created in 2021 could still be in force seven years later.

What was voted on 9 July

The vote did not reactivate Chat Control 1.0 immediately. Parliament was at the second-reading stage of the procedure and had to decide on the position adopted by the Council on 2 July.

First, a proposal to reject it completely was put to a vote, receiving 314 votes in favour of rejection, 276 against and 17 abstentions. Although rejection received more votes in favour than against, it did not pass because an absolute majority of 361 MEPs was required at this stage.

Several amendments were then approved. The most important excludes communications to which end-to-end encryption (E2EE) applies, has applied or will apply.

Protecting encryption was one of the demands promoted by the Group of the Greens/European Free Alliance. Czech MEP Markéta Gregorová, a member of Česká pirátská strana, defended this condition during the negotiations and welcomed the fact that the absolute majority needed to preserve encryption had been reached. Gregorová also criticised the fact that, despite this protection, the voluntary and mass analysis of all other communications not using E2EE would continue. Her statements can be found in Reuters’ report on the vote.

The result and next steps are set out in the European Parliament’s official press release. Parliament has also published the text approved on 9 July 2026.

The amended position now returns to the Council, which has a maximum of three months to accept all the changes, although it may decide sooner. If it accepts them, the Regulation can be adopted, published and enter into force. If it does not, Parliament and the Council will have to try to agree on a common text through a conciliation procedure.

Excluding E2EE does not solve the problem

Leaving E2EE communications out is a necessary limitation. However, this amendment does not make Chat Control 1.0 ethical or respectful of privacy. Moreover, the fact that the exclusion of E2EE communications was secured by only 9 votes makes the future awaiting us quite clear…

Many of you may think that all communications nowadays use E2EE technology. Let me tell you that you are very wrong. Here are some examples of communications that DO NOT use E2EE:

• Conventional emails sent without OpenPGP, S/MIME or another specific end-to-end encryption system, including ordinary Gmail, Outlook and Yahoo Mail emails.
• Private and group messages on Instagram, whose end-to-end encryption was removed on 8 May 2026.
• Normal Telegram chats, groups and channels (E2EE chats are not enabled by default).
• Private and group text messages, as well as messages posted on Discord servers. E2EE applies to audio and video calls, but not to written messages.
• Microsoft Teams messages and channels. Its E2EE is limited to certain one-to-one calls when the organisation and both users enable it.

These are not hypothetical examples. The European Commission’s 2025 report confirms that Google, LinkedIn, Meta and Microsoft processed data under Chat Control 1.0.

What Chat Control 1.0 actually allows

Chat Control 1.0 creates an exception to the confidentiality protected by Articles 5(1) and 6(1) of Directive 2002/58/EC, known as the ePrivacy Directive. Regulation 2021/1232 itself acknowledges that it restricts the confidentiality of communications.

Thanks to this exception, providers can make use of Chat Control 1.0 to deploy specific technologies for analysing the content and related traffic data of all their users’ private conversations.

The regulation constantly uses the word “voluntary”, but this “voluntary” choice belongs to the provider, not the user. The company decides whether to apply these technologies within its service, and users cannot choose whether they want their communications to be violated.

Nor is an individual court order required to analyse each account. The system can examine the communications of people against whom there is no prior suspicion.

These technologies can be used to search for known material, detect potential material that has not yet been identified and find conversation patterns related to the sexual grooming of minors.

This approach introduces several problems that cannot be made to disappear with a more accurate tool or a promise of ethical use. To search for content, legitimate communications have to be analysed, full stop. Confirming an alert about new material requires human intervention to review it. Detecting variants requires systems based on similarities and probabilities, which means the problem of false positives will always exist. If a report is shared, new points of exposure arise, opening up the possibility of a leak.

False positives, exposure during human review, insecure data retention and the increased attack surface are not merely implementation errors; they are consequences inherent in the very nature of the measure. Safeguards can be added to try to mitigate these risks, but the possibility of them occurring can never be eliminated completely.

Previously known material

Companies can compare images and videos sent through their services with digital fingerprints belonging to previously identified material.

An exact cryptographic hash such as MD5 can only recognise a file containing exactly the same bytes. For the purpose pursued by Chat Control 1.0, using an exact hash is useless and cannot be used effectively. If a single byte of the file is changed, the result no longer matches even if the image continues to show exactly the same thing.

For this reason, the detection of modified copies relies on perceptual hashes. Instead of representing every byte, this technology extracts visual features from the image or video and generates a fingerprint of its appearance. It then compares the distance between that fingerprint and those stored in a database, and if the distance falls below the defined threshold, it flags a potential match.

This approach makes it possible to recognise cropped, compressed, rotated or filtered versions. It also means that the system is no longer checking whether two files are identical, but deciding whether they are sufficiently similar according to the chosen model and threshold. The more the system tries to resist modifications, the greater the need to accept approximate matches and the greater the risk of flagging legitimate content, increasing the number of false positives.

The European Commission mentions that technologies such as PhotoDNA, CSAI Match, PDQ, TMK+PDQF and MD5 Hash Matching were used in its 2025 implementation report.

Previously unidentified material

When the material is not yet known, there is no previous fingerprint against which to compare it. In these cases, classifiers and artificial intelligence are used to analyse an image or video and calculate the probability that it depicts child sexual abuse.

The result is not a certainty; it is a prediction based on possible indicators.

The provider can adjust the tool’s sensitivity level. If it lowers the threshold in an attempt to detect more genuine cases, the amount of legitimate content flagged also increases; if it raises the threshold to reduce incorrect alerts, the risk of letting actual child sexual abuse material through will increase.

That balance is left in the hands of the company configuring the system, opening up the possibility of deliberately forcing matches in as many chats as possible in order to obtain “legitimate permission” to proceed with scanning them.

Sexual grooming of minors

Chat Control 1.0 also allows written conversations to be analysed for patterns related to the sexual grooming of minors, or grooming.

Article 3 of Regulation 2021/1232 lays down the conditions on which this detection technology must be based, limiting it to relevant indicators and objectively identified risk factors, such as an age difference and the probable involvement of a minor. Furthermore, it should not be capable of inferring the general content of the conversation, but only of flagging patterns associated with potential abuse.

Even with those limitations, we are still talking about an automated system that examines private conversations to decide which ones appear suspicious.

Human language depends on context. A sentence can change meaning completely depending on who says it, whom it is addressed to and the messages surrounding it. A joke, a family conversation or a cultural difference can be misinterpreted by a classifier.

What companies can do after a detection

Article 3 of Regulation 2021/1232 allows providers to take several measures after detecting suspicious content or behaviour.

1. Review the alert. When it concerns potential new material or the sexual grooming of minors, a person may access the content to confirm or dismiss the automated detection.

2. Remove or block the content. The provider can prevent the material from remaining available within the service.

3. Block or suspend the account. It can also restrict the user’s access, interrupt the service or terminate its provision.

4. Submit a report. A suspicion that the company considers substantiated and verified may be sent to the competent authorities or to organisations acting in the public interest against the sexual abuse of minors.

5. Create a new digital fingerprint. If the material has been reliably identified, the provider can generate a non-reversible hash to facilitate future detections.

6. Retain data related to the case. The company can store the information for as long as it considers strictly necessary for the permitted purposes. The general limit is twelve months from detection.

The 4 main problems

False positives

False positives are not merely a theoretical possibility. While Chat Control 1.0 was in force, Google, Meta, Microsoft and Yubo reported widely varying error rates:

The case that illustrates this problem most clearly is Yubo’s. In 2023, one in every five automatically generated alerts was dismissed after a human reviewed the content. The system had flagged those communications as potential indications of a serious crime, but the human review confirmed that they were false positives.

All these figures can be found in section 2.1.6 of the European Commission’s report.

The figures are not directly comparable because each provider used a different method to calculate them. This is not reassuring; it shows that there is not even a common and transparent way to measure the accuracy of tools capable of triggering a review of our communications.

The seriousness of a false positive does not depend on whether the overall rate appears high or low. Every error turns a legitimate communication into suspicious material and can expose the private life of someone who has committed no crime.

The human factor in the review process

When new material or potential grooming behaviour is detected, the content cannot be submitted as a report without prior human confirmation. The Council’s 2026 position maintains this requirement.

Human review prevents an automated alert from immediately becoming a report. However, in order to confirm or dismiss that alert, someone must access the flagged content.

Imagine sending a relative a photograph of a bank card so that they can copy the details (a completely inadvisable practice). If the conversation is incorrectly associated with an alert, some of that information may end up in front of the person responsible for reviewing it.

Now imagine two adults consensually sharing an intimate photograph. A classifier looking for nudity, sexual content or certain visual patterns may flag it even though it is entirely legal. To dismiss the alert, someone outside that relationship would have to review it. The European Data Protection Supervisor has expressly warned of the risk that these technologies may flag images produced and shared consensually.

The Regulation requires providers to establish internal procedures to prevent abuse, unauthorised access and improper transfers. This obligation appears in Article 3(1)(g) of the Regulation.

The existence of controls does not eliminate the risk. No system can guarantee that internal abuse, a leak or unauthorised access will never occur.

Reports do not go exclusively to law enforcement agencies

In my view, this is one of the most concerning points in the Regulation.

Providers can send reports not only to law enforcement authorities, but also to organisations acting in the public interest against the sexual abuse of minors.

The European Commission’s 2025 report shows that companies stated that they had shared data with the following entities.

Google, LinkedIn, Meta, Microsoft and Yubo stated that they shared information with NCMEC. Yubo also reported transfers to IWF and PHAROS.

These organisations may perform valuable work, but that does not mean the model should not be questioned. A private company can analyse a private communication and send sensitive information to another private organisation located outside the European Union without an individual court order against the user.

As a user, numerous questions come to mind about the safeguards governing the processing of my information.

• Who guarantees that these organisations will keep my information secure?
• Who checks that it is never reused to obtain an economic advantage, train tools or feed other databases?

I am not claiming that the entities mentioned are using the data for these purposes. My concern is that the system forces me to trust a chain of companies and organisations that I did not choose. A legal obligation to comply with the GDPR is not the same as a technical guarantee that improper retention, hacking or leaks will never occur.

I also wonder when exactly we accepted that entities/organisations should become part of a chain that receives intimate communications and personal data. If investigating a potential crime is deemed necessary, state law enforcement agencies should intervene under clear judicial oversight. Adding private organisations to that chain increases the number of people and systems with access to information that should never have left a private conversation.

Increased attack surface

Maintaining the privacy of a communication becomes more difficult as the number of systems and people able to access it grows.

In a communication properly protected by E2EE, we know that the content should only be available on the sender’s and recipient’s devices. An attacker seeking access to that communication would have to compromise one of those endpoints. Although Chat Control 1.0 does not yet apply to E2EE (for now), the increased attack surface is real for all other communications.

When a detection system is introduced, new sensitive points emerge. There are tools that analyse content, systems that generate alerts, internal dashboards used by employees, databases where information is retained and channels through which reports are sent to third parties. All of this causes the attack surface to grow.

An attacker no longer has to limit themselves to compromising the sender or recipient. They can also try to access the infrastructure where alerts are stored, attack employee accounts, exploit a misconfiguration or compromise one of the organisations receiving the data.

The Regulation requires secure storage and procedures against unauthorised access. This obligation establishes an objective, but it cannot guarantee the outcome; no system is 100% secure. Unknown vulnerabilities, configuration errors, stolen credentials, provider failures, insider threats and supply-chain attacks can all leave our data at the mercy of cybercriminals.

Every copy, every transfer and every new point of access adds another opportunity for a private communication to end up in the hands of someone who should not see it.

For the sake of the children

We have reached a point where any criticism of Chat Control seems to place us against protecting children, which is a very effective way to avoid the debate.

Paedophiles and other abusers are criminals. Criminals will always try to stay one step ahead of security measures. Those with even minimal technical knowledge will be able to use end-to-end encryption, encrypt their own communications before sending them, switch services or move to platforms beyond the reach of the European Union.

They can also initiate contact with a minor on a platform covered by Chat Control 1.0 and, before beginning any criminal activity, persuade them to continue the conversation on a service with E2EE or one beyond the regulation’s reach. The initial approach could take place on an analysed channel, but the criminal activities would ultimately move to other channels outside the regulation.

Ordinary users will continue to use the best-known services. They will not switch platforms, manually encrypt their files or, in many cases, even know what protection their email provider or application uses. Their legitimate communications will be the ones that remain exposed to automated analysis.

This severely limits the regulation’s effectiveness. Criminals capable of adapting will abandon monitored channels, while the system will continue examining the communications of millions of people who are not trying to conceal any crime. This measure may detect a few offenders who take no precautions, but it does not eliminate criminal networks or prevent them from moving their activities to safer spaces.

The result is a measure with a disproportionate scope and limited effectiveness, sacrificing the confidentiality of legitimate users without ensuring that the principal offenders continue using services subject to this control.

The European Data Protection Supervisor warned in February 2026 that the regime still fails to provide specific and effective safeguards against general and indiscriminate surveillance. It also pointed to the lack of a sufficiently clear legal basis for processing data under the GDPR.

From my point of view, the protection of children is being used to make a surveillance infrastructure acceptable when it would be much harder to defend with any other argument. The seriousness of child sexual abuse provokes an understandable emotional response, and that is precisely why it is used to present every limitation as an obstacle and every criticism as a lack of commitment to victims.

However, a measure does not become valid simply because its purpose is legitimate; it must demonstrate its effectiveness and proportionality. As we have already discussed, a measure that affects every citizen and is clearly ineffective because it is absurdly easy to circumvent demonstrates that it does not meet these criteria.

There are more proportionate alternatives. More resources can be devoted to police investigations, infiltration of criminal networks, international cooperation, removal of public content, specialised teams, protection of minors within platforms and, most importantly, PARENTAL CONTROL. The last of these is the most effective measure: parents must be responsible for knowing what their children are doing in the digital world.

Protecting children and respecting privacy are not incompatible goals. Presenting them as though we had to choose one or the other only serves to avoid a debate about the limits of surveillance.

The beginning of the end of digital confidentiality

The greatest danger is not limited to the current purpose, but lies in the construction of an infrastructure capable of analysing private communications, generating alerts, retaining data and sending it to third parties. This infrastructure will continue to exist after this extension, providers will already have developed the tools, reporting channels will be operational and the legal exception will have helped normalise this model. All of this paves the way for Chat Control 2.0.

Chat Control 2.0 aims to replace this temporary regime with a permanent framework. The proposal includes the possibility of imposing detection orders on certain providers to search for child sexual abuse material and potential cases of grooming. What is now presented as a voluntary decision by companies could become a legal obligation imposed by an authority.

Therefore, Chat Control 1.0 should not be understood as an isolated temporary measure. This temporary framework is allowing the technologies, procedures and reporting channels that could later be used to implement Chat Control 2.0 to be developed and kept operational. It is also accustoming society to accepting that private communications are analysed preventively.

For me, that is where the beginning of the end starts. Not because all privacy will disappear overnight, but because the legal instrument is being created and the idea that will allow it to be extended with less resistance in the future is being accepted. Once surveillance is part of the infrastructure, the next debate is no longer whether it should exist, but what else it can be used for.

Answer these questions

Imagine cameras and microphones being installed in every room of your home, along with a system that analyses what you do and say and, whenever it finds something suspicious, sends part of the recording to a stranger so that they can decide whether you have committed a crime.

No one is investigating you based on actual evidence that you are committing a crime. Instead, the system analyses your private life because there is a possibility that anyone might commit one.

Where is the limit?

Would you speak with the same freedom about any subject?

Would you share the same information with your partner, friends or family?

Would you accept that system simply because you are assured that it is being used to prosecute serious crimes?

Our digital communications are part of our private lives, and we use them to speak with relatives, friends and partners. If we know that a system can analyse them and that an error can expose them to a stranger, we will begin to measure what we say and what we do. This is called losing freedom.

I think it is fair to say that if you would not accept this level of surveillance inside your home, you should not accept it in your digital conversations either.

What we can do

At the time of writing, the extension of Chat Control 1.0 has not yet been definitively approved. The legislative file remains pending a second-reading decision by the Council.

What we can do depends on the stage reached by the procedure and which institution is able to intervene at that point.

Current phase: Pressure national governments meeting in the Council

The next decision lies with the Council of the European Union, the institution representing the governments of the Member States. Its meetings are attended by the relevant national ministers according to the subject under discussion, and each of them defends their government’s position. Its structure and operation can be found on the Council of the European Union’s official website.

Citizens in each Member State must therefore direct pressure towards their government, the ministries involved and their country’s permanent representation to the European Union.

As things stand today, the most useful actions in a fully functioning democracy would be:

1. Contact the government and the relevant ministries to express our concerns.
2. Ask our country to reject any text that allows private communications to be analysed without prior suspicion or judicial authorisation.
3. Support coordinated campaigns across different Member States to prevent the Council from reaching the required majority.

Let us be realistic: sending an email to our country’s officials will not change anything on its own. The only way to exert real pressure is to organise at a social level, use social media, make noise and demonstrate widespread discontent with Chat Control 1.0. Citizen organisation is vital to demonstrate our rejection of the regulation throughout the European Union.

If we fail to stop it and the Council accepts all the amendments approved by Parliament on 9 July, the Regulation will be adopted with those changes and may enter into force after publication. In that case, there will be no new vote in Parliament.

If the Council does not accept all the amendments

If the Council does not accept all the amendments approved by Parliament, a conciliation procedure will begin in an attempt to reach an agreement between the two institutions.

The Conciliation Committee will consist of the members of the Council or their representatives, one from each Member State, and an equal number of MEPs. Parliament’s delegation will be chaired by the President of Parliament or by one of the vice-presidents responsible for conciliation. The rapporteur for the file and the chair of the responsible parliamentary committee will also be members. The political groups will appoint the remaining members.

The European Commission will participate in the meetings to try to bring Parliament’s and the Council’s positions closer together, although the final decision will rest with the representatives of both institutions.

If Chat Control 1.0 reaches this stage, pressure will have to be maintained on both fronts. On the one hand, citizens will have to continue pressuring governments over their participation as members of the Council. On the other, it will be necessary to contact the MEPs who form part of Parliament’s delegation and demand that they do not accept a common text that would allow European citizens to be spied on indiscriminately.

If Parliament and the Council fail to agree on that text within the established deadline, the entire proposal will be deemed not adopted and Chat Control 1.0 will remain out of force. The European Parliament officially explains the composition and operation of this stage.

If the text returns to the plenary

If conciliation results in a joint text, it will have to be approved again by Parliament and the Council. Neither institution will be able to introduce new amendments. Parliament will require a simple majority of the votes cast, while the Council will require a qualified majority.

Using the turnout recorded on 9 July as a reference, the figures would be as follows:

Parliament’s figures depend on turnout, so the table is based on the 590 valid votes and 17 abstentions recorded on 9 July.

During that vote, 314 MEPs supported the rejection of Chat Control 1.0 and 276 voted against it. However, rejection required an absolute majority of 361 votes and did not pass. The full result of the vote can be found here.

A simple majority would apply at third reading. If the same distribution were repeated, with 314 votes against the joint text and 276 in favour, Chat Control 1.0 would be rejected.

This stage would open up another opportunity to stop the proposal. Pressure should be directed at all MEPs to vote for the Rejection of Chat Control 1.0. The European Parliament explains the rules for the third reading, and the Council details how qualified-majority voting works.

How the Spanish representatives voted

The votes of the Spanish MEPs were distributed as follows:

Partido Popular and PSOE, including PSC-PSOE, accounted for 36 of the 37 Spanish votes against rejection. The remaining vote was cast by Alvise Pérez.

In total, seven Spanish MEPs did not take part in the vote. Four belong to Partido Popular, two to Vox and one to PSOE.

These are the names of the MEPs who, in my view, were in too much of a hurry to start their holidays:

You can verify these absences in the roll-call result of the vote by filtering by country and Did not vote.

Fight Chat Control

Fight Chat Control is a citizens’ initiative opposing Chat Control. Its website brings together information about Chat Control 1.0 and Chat Control 2.0, the votes that have taken place and the positions of different political representatives. It also provides resources for finding and contacting MEPs.

The platform is especially useful for finding out which representatives support these measures, following the measure’s current status and helping to coordinate public opposition across different countries.

I encourage you to visit the website, share its resources and contact as many political representatives as possible. A genuinely European campaign will have far more strength than several isolated protests within individual countries.

The official status of Chat Control 1.0 can be followed in the 2025/0429(COD) legislative file.

Conclusion

Chat Control 1.0 affects us all because it allows private communications to be analysed without any prior investigation/suspicion concerning the people participating in them.

Excluding E2EE technology reduces the regulation’s scope, but it does not solve the problem. Emails, messages, images and videos sent without that protection still lose a confidentiality that should be guaranteed as a right.

Allowing Chat Control 1.0 means accepting that all of us can be subjected to automated surveillance on the pretext that one of us might commit a crime. This affects the freedom with which we speak, the information we share and the relationship of trust we have with our digital communications.

A democracy must pursue criminals through targeted investigations, judicial oversight and proportionate measures. Not through the preventive analysis of the entire population’s conversations.

If we accept this model, we will be allowing a surveillance tool designed to expand its reach in the future. Today it is presented as a limited exception; tomorrow it could become the technical and legal basis for much broader control.

Sources and documents consulted

• Directive 2002/58/EC, or the ePrivacy Directive
• Regulation 2021/1232
• Regulation 2024/1307
• Result of the vote on 9 July 2026
• Text approved by the European Parliament
• Position of the Council of the European Union
• European Commission’s 2025 report
• Opinion 7/2026 of the European Data Protection Supervisor
• 2025/0429(COD) legislative file
• Ordinary legislative procedure and conciliation stage
• Javier Zarzalejos’ European Parliament profile
• Council of the European Union
• Justice and Home Affairs Council
• Council voting system
• Reuters information on the push to protect E2EE