The European Parliament has voted against proposals that would allow social media and tech companies to continue to scan the content of private messages of EU citizens for illegal content.
A majority of MEPs voted on Thursday 26 March to reject extending a temporary exemption to EU privacy laws that permitted companies such as Meta, Google and LinkedIn to “indiscriminately” scan private messages for child abuse. The decision marks the end of a long-running attempt to introduce Chat Control legislation across Europe.
In its original form, Chat Control would have required technology companies to monitor the content of end-to end encrypted communications, raising objections that it would undermine cyber security and put confidential communications at risk.
US tech barred from scanning private messages
In the vote, 311 MEPs voted against a motion to extend a derogation to the e-Privacy directive, with 228 votes in favour, and 92 abstentions, which means that tech companies can no longer legally conduct mass scanning of private messages.
Law enforcement agencies will be able to continue to conduct surveillance of private messages when they have concrete suspicions and have obtained a judicial warrant, and will be able to conduct routine scanning of public posts and files.
The European Commission first presented a proposal to require all email and messaging providers to conduct mass scanning of all messages and emails sent on their platforms, including end-to-end encrypted messages in 2022. The proposals attracted criticism from technology companies and lawyers.
In 2024, European tech companies warned in an open letter that the proposals would “negatively impact children’s privacy and security” and could have “dramatic unforeseen consequences” for cyber security.
Leaked internal legal advice showed that the Council of Europe’s own lawyers had serious questions about the lawfulness of the planned measures, which they said could lead to the de facto “permanent surveillance of all interpersonal communications”.
PhotoDNA flawed
A scientific study published this month found that the “PhotoDNA” technology used by tech companies for Chat Control was “unreliable”. They found that criminals can fool the software into missing illegal images and that harmless images can be manipulated so that innocent citizens are reported to the police.
According to a European Commission report, just 36% of suspicious activity reports from US tech companies originated from the surveillance of private messages, while social media and cloud storage services are becoming increasingly relevant for investigations.
US tech companies are permitted to carry out mass scanning of private messages under an EU interim regulation which now expires on 3 April. The regulation allows “hash scanning” for known images and videos, automated analysis of previously unknown images and videos and automated analysis of text in private chats.
Lobbying exercise
Patrick Breyer, who has been campaigning against Chat Control, said that tech companies – such as US tech company Thorn – and lobby groups had been trying to “panic” Europe into introducing the measures.
“Flooding our police with false positives and duplicates from mass surveillance doesn’t save a single child from abuse. Today’s definitive failure of Chat Control is a clear stop sign to this surveillance mania,” he said. “Indiscriminate mass scanning of our private messages must finally give way to truly effective and targeted child protection that respects fundamental rights.”
The European Commission, European Parliament and the European Council are continuing negotiations on a permanent regulation, dubbed Chat Control 2.0. The European Parliament has been pressing for targeted measures rather than mass surveillance since 2023.
