Despite Opposition, EU Lawmakers Extend Tech Firms' Right to Scan Private Messages

The European Parliament has taken a controversial step, extending legislation that permits tech companies to voluntarily scan users’ private messages for child sexual abuse material (CSAM). This decision came despite a clear majority of lawmakers voting against the proposal, highlighting a deep division within the legislative body regarding digital privacy and child protection. The ruling effectively reinstates permissions for major firms, including Meta, Google, and Microsoft, to scrutinize private text, email, and social media messages under a bill critics have dubbed “Chat Control.” Notably, end-to-end encrypted chats, such as those offered by WhatsApp and Signal, remain exempt from this scanning mandate. Critics are vocal about the profound implications for digital privacy. Simeon de Brouwer, a policy adviser at the Brussels-based advocacy group European Digital Rights, warned of the potential for private companies to undermine the right to confidential digital conversations. He stated, “They could, if they want to, read every message you write, every email you send, every picture you share.” This sentiment underscores a significant fear among privacy advocates: that the voluntary nature of the scanning could evolve into a broader surveillance tool, eroding the fundamental expectation of privacy in digital communications. The push for this extension was spearheaded by the European People's Party (EPP), the largest political group in the European Parliament. They have been actively working to restore the legal basis for tech firms to scan messages since a prior law expired in April. EPP members argue that the voluntary detection activities of these companies have been instrumental in identifying and rescuing victims of online child sexual abuse, asserting that disallowing such measures would leave children vulnerable and unprotected. With the parliament dispersing for its summer break at the end of the month, the EPP was in a race against time to reinstate the legislation, with party vice-chair Tomas Tobé emphasizing, “We cannot go to the summer recess knowing that our children are not protected.” However, the significant implications for privacy have ignited fierce opposition from other political parties and civil rights activists across Europe. Faced with collapsing talks in March, the EPP resorted to a procedural maneuver known as an “urgent procedure” to force fresh votes on the legislation this week. This tactic bypasses preliminary committee debates, where amendments are typically introduced and discussed. Crucially, this procedure stipulates that the regulation would pass unless an absolute majority of 361 Members of the European Parliament (MEPs) voted against it. In the final vote on Thursday, more MEPs voted against the regulation than voted for it. However, the opposition fell short of the required absolute majority by 47 votes, meaning the legislation passed. Consequently, tech companies will retain the right to scan messages for child sexual abuse detection until 2028, or until permanent legislation, which is currently under discussion and also referred to as “Chat Control” by its detractors, replaces it. This outcome has been met with strong condemnation from civil rights activist and former MEP Patrick Breyer, who decried the ruling as a “farce” that “damages democracy.” Breyer further elaborated in a blog post, stating, “Our children are the real losers in this undemocratic process. Trying to protect children with suspicionless mass surveillance is like frantically mopping the floor while the faucet is still running. Blanket chat control is just as unacceptable as indiscriminately opening everyone’s physical mail.”