The European Parliament has passed amendments that would shield end-to-end encrypted communications from a proposed EU exemption allowing electronic services to voluntarily scan private messages for child sexual abuse material. The vote, held Thursday, marks a significant intervention in one of digital policy's most contested fault lines: the tension between protecting children online and preserving the architectural integrity of encrypted communications. The amended Parliament position now moves to the Council, which has three months to accept or reject it.
What the Vote Actually Decided
The derogation at issue - a carve-out from the EU's ePrivacy rules - would permit communications providers to voluntarily detect child sexual abuse and the solicitation of minors in private messages, and to remove and report relevant material. The Council's position sought to revive a version of this exemption after an interim law linked to it lapsed on 3 April 2026, following the Parliament's earlier refusal to extend a Commission proposal at first reading.
Thursday's vote was not a clean procedural win. A first ballot showed 314 MEPs in favour of rejecting the Council position outright, against 276 opposed and 17 abstentions - short of the absolute majority of 360 required at second reading to block or alter the Council text. A subsequent vote on the Parliament's own amended position then failed to secure a majority for rejection, with 276 in favour, 286 against and 30 abstentions. The procedural result closed the second reading, meaning the Parliament's amendments - crucially, the exclusion of end-to-end encrypted communications from the exemption's scope - now constitute the Parliament's formal position.
The key amendment is precise in its language: it would exclude "communications to which end-to-end encryption is, has been or will be applied." The forward-looking clause - "will be applied" - is particularly notable. It appears designed to prevent providers from pre-emptively scanning content before encryption is applied, a technique sometimes described as client-side scanning, which has drawn sustained criticism from cryptographers and civil liberties advocates.
Why Encryption Is the Central Fault Line
End-to-end encryption is a mathematical guarantee that only the communicating parties can read a message's content. The server or platform carrying that message holds no key capable of decrypting it. This architecture underpins the security of hundreds of millions of private communications globally - among journalists, lawyers, activists, abuse survivors, and ordinary users with no interest in anything other than privacy.
The practical consequence is that any system designed to scan the content of end-to-end encrypted messages must, by definition, either break the encryption or conduct scanning at the device level before encryption occurs. Neither approach is technically neutral. Breaking encryption on behalf of law enforcement or platform safety systems creates vulnerabilities that cannot be selectively limited to approved uses. Client-side scanning, meanwhile, effectively installs a monitoring mechanism on users' own devices - a design that many security researchers argue is indistinguishable in principle from spyware, regardless of the stated purpose.
EU institutions have wrestled with this tension for years. The broader "Chat Control" proposal - the Commission's attempt to establish a permanent framework for mandatory detection of child sexual abuse material in private communications - has stalled repeatedly over precisely these objections. Thursday's vote is downstream of that larger, unresolved debate.
Where the Process Goes From Here
With the second reading closed, the amended Parliament position travels to the Council. If the Council accepts all the amendments, the text becomes law. If it does not - and given that the Council's original position contained no such encryption carve-out, disagreement seems plausible - the two institutions enter conciliation, a time-limited negotiation process aimed at producing a joint text both sides can accept.
The derogation is explicitly framed as a temporary measure. Negotiations on a permanent EU framework to combat child sexual abuse online have been ongoing, with most substantive points reportedly agreed during the Cyprus Presidency in the first half of 2026, though certain issues remain unresolved. The interim law this derogation was meant to sustain has already lapsed, meaning there is currently no EU-level legal basis for the voluntary detection activity the exemption would cover. That gap creates its own pressure on both institutions to reach a workable compromise.
What that compromise looks like will matter considerably. A framework that excludes encrypted communications from detection obligations effectively preserves strong encryption as a baseline. A framework that does not creates either a legal incentive for platforms to weaken encryption or a de facto mandate for client-side scanning - outcomes that privacy advocates and security experts have consistently argued would cause systemic harm disproportionate to the investigative benefits claimed.
The Broader Stakes for Digital Rights in Europe
Thursday's vote does not resolve the underlying policy question, but it establishes a firm institutional signal from the Parliament: the protection of encrypted communications is not a secondary consideration to be traded away in the name of child safety. Both values, the Parliament's position implicitly argues, must be pursued - and the mechanisms used to advance one must not structurally undermine the other.
That framing has implications well beyond this particular dossier. The EU is simultaneously advancing its data protection framework, the AI Act's provisions on biometric and behavioural surveillance, and a range of digital governance instruments that collectively define the conditions under which personal communications can be monitored in Europe. How the Council responds to Parliament's encryption carve-out will be an early indicator of which direction that broader architecture is moving.
