Gmail inboxes, Instagram DMs, and Discord chats are once again subject to voluntary EU-authorized surveillance app-era scrutiny — not because platforms are required to act, but because Parliament lacked the votes to stop them. As of July 9, 2026, major platforms have explicit EU legal permission to scan private messages, emails, and files for child sexual abuse material. The mechanism that restored this authority wasn’t a sweeping new policy debate. It was a procedural threshold that opponents simply couldn’t clear.
A Law That Wouldn’t Stay Dead
Chat Control 1.0 expired in April, only to be resurrected through a procedural maneuver three months later.
The original Chat Control 1.0 — formally Regulation (EU) 2021/1232 — allowed platforms to voluntarily scan private messages, emails, and files for CSAM without violating EU privacy rules. Parliament voted to let it expire in April 2026.
The Council fast-tracked an essentially identical regulation in July. Blocking it required an absolute majority of 361 MEPs. Only 314 voted to reject, with 276 voting against rejection and 17 abstaining.
The law was deemed adopted. Chat Control 1.0 is back until 2028.
That procedural math deserves a moment. A majority of voting MEPs opposed revival, but the threshold was set high enough that opposition didn’t matter — not unlike cookie-consent banners, where the system technically offers a choice while engineering the outcome it wanted all along.
Here’s what falls under the revived regime:
- Gmail, Outlook, iCloud email, and other non-end-to-end-encrypted email services
- Instagram and Facebook Messenger DMs, Discord, Snapchat, and Xbox chat
- Platforms using tools like Microsoft’s PhotoDNA and AI-based classifiers to flag suspected CSAM through a child safety coalition of voluntary reporting frameworks
- A critical carve-out: fully end-to-end encrypted services like WhatsApp and Signal are explicitly excluded from the scanning regime
Notably, European providers have largely declined to implement Chat Control scans. It has primarily been US-based platforms — Meta, Google, Microsoft, Apple — that have leveraged the derogation to scan user content.
Two Camps, One Unresolved Fight
Privacy advocates call it surveillance theater; tech companies call the alternative irresponsible.
EDRi, the European digital-rights organization, has characterized scanning innocent people’s private communications with AI filters as “textbook mass surveillance” that is “not very effective,” according to the group’s published analysis. Patrick Breyer, a prominent critic, warns the approach floods authorities with false positives while failing to demonstrably protect children — and hands US tech giants disproportionate access to Europeans’ private communications, akin to how governments have been caught secretly tracking users through other means.
The other side hits back. In a joint statement reported by Politico, Microsoft, Amazon, and Google called the earlier lapse in scanning authorization “irresponsible,” arguing voluntary detection remains critical to maintaining CSAM reporting levels to law enforcement.
The far more aggressive Chat Control 2.0 — which would mandate scanning across all platforms, potentially requiring client-side scanning of encrypted services — remains stalled. Signal has publicly threatened to exit the EU market rather than implement such measures. Germany continues to oppose the proposal. Negotiations are expected to resume later this year, and the question of what platforms can see inside your private communications is nowhere near settled.
