On Thursday (9 July), the European Parliament plenary voted to amend, rather than reject, a Council proposal that would let electronic communication services voluntarily scan for child sexual abuse material online, in a chaotic session that leaves the future of the law in the hands of EU member states. The vote matters because it determines whether platforms such as WhatsApp, Signal and email providers can keep detecting and reporting abusive content after a previous version of the rules expired in April, and because it introduces a significant carve-out for end-to-end encrypted communications.
A law that keeps coming back from the dead
The measure in question is a “derogation”, meaning a temporary legal exception, from the EU’s ePrivacy rules, which normally restrict how communication providers can scan or monitor private messages. This particular derogation allows firms to voluntarily detect child sexual abuse material and grooming behaviour on their platforms, and to remove and report what they find. It was designed as a stopgap while the EU negotiates a permanent, more comprehensive law on the issue.
However, in March, MEPs rejected a Commission proposal to extend it, causing the interim law to expire in April. The Council of the EU, which represents national governments, then sent the file back to Parliament for a second reading. That set the stage for Thursday’s vote, which MEPs described as confusing even as it unfolded, with several complaining they did not fully understand the procedure they were voting under.
A narrow result and a fight over encryption
Under EU second-reading rules, opponents needed an absolute majority (360 votes) to reject the Council’s position outright. They fell short, with 314 in favour of rejection against 276 opposed. A subsequent vote on the amended Parliament text also failed to secure a majority, meaning Parliament’s position, as amended, will now be sent back to the Council.
The most consequential of those amendments excludes “communications to which end-to-end encryption is, has been or will be applied” from the scope of the detection rules, effectively shielding apps like WhatsApp and Signal from the scanning requirements.
What happens next
The amended text now goes to the Council, which has three months to accept or reject Parliament’s changes, including the encryption exemption. If the Council agrees, the law can proceed. If it does not, the file moves to “conciliation”, a formal negotiation process between Parliament and Council used only once since 2013, reflecting how rarely EU institutions reach such an impasse. A European Commission spokesperson said it would assess the changes but stressed the urgency of protecting children online.
