The EU Parliament voted to extend Chat Control 1.0, but with a significant constraint attached.

By 458 votes to 103, MEPs approved extending the regulation until August 2027 while simultaneously passing an amendment that bans untargeted mass scanning of private communications.

Any scanning under the extended regime must now be strictly limited to individual users or groups of users where a competent judicial authority has established a link to child sexual abuse.

That’s a win on paper. For five years, Chat Control 1.0 has operated as a voluntary surveillance framework, letting platforms scan private messages at scale with no requirement for individual suspicion.

The EU Commission’s own implementation report put the false positive rate as high as 20%. Millions of private conversations scanned, one in five flags landing on someone who did nothing wrong.

The amendment, tabled by Pirate Party MEP Markéta Gregorová, demands that surveillance be targeted and judicially authorized before it happens. Not after the fact, not algorithmically determined, and approved by a court, applied to a specific suspect.

Digital rights campaigner Patrick Breyer called it a turning point. “Today is a sensational victory for the countless citizens who made calls and sent emails to save their digital privacy of correspondence,” he said, adding that “just as with our physical mail, the warrantless screening of our digital communications must remain taboo.”

The vote also puts immediate pressure on the institutions that have resisted any such limits. The European Commission and the vast majority of the EU Council have so far rejected any restrictions on untargeted mass scanning outright. Italy is the only Council member that has not opposed constraints. That political resistance doesn’t disappear because Parliament voted though. It moves to the negotiating table.

Trilogue negotiations between Parliament, the Commission, and the Council began on March 12, operating under tight time pressure: the current interim regulation expires on April 6.

Whatever comes out of those talks could look very different from what Parliament just approved. The Commission’s position hasn’t shifted. The Council’s appetite for targeted-only scanning remains limited. Parliament’s amendment is a mandate, not a guarantee.

Chat Control 2.0 continues on its own track. The second trilogue on the permanent regulation was held on February 26. Two more sessions remain, with a third scheduled for May 4 and a fourth, expected to be the final round, on June 29. Adoption is anticipated by July 2026.

The current text of 2.0 has dropped mandatory scanning of end-to-end encrypted messages, but retains a requirement that users verify their age before accessing encrypted messaging services.

Anonymous encrypted communication, under that framework, ends. The encryption “survives,” but the anonymity doesn’t.

The vote was the best outcome from a Parliament session that could easily have gone the other way. But it’s an interim measure, passed under deadline pressure, heading into negotiations with institutions that don’t share its position.

Breyer’s framing captures the stakes: this increases pressure on EU governments to bury untargeted mass surveillance for good. Whether that pressure holds through trilogue is the question that matters now.