The EU Just Legalized Scanning of Private Messages Without a Warrant

On July 9, 2026, the European Parliament allowed a law nicknamed “Chat Control” to pass, even though most of the lawmakers who showed up to vote were against it. The measure permits tech companies operating in the European Union to scan private messages, emails, and chats for law enforcment purposes without first getting a warrant or having any suspicion that a specific person has done anything wrong. It is now legal across all 27 member states until April 2028.

The vote itself shows how strange the outcome was. Of the 607 members who voted, 314 voted to reject the law and only 276 voted to keep it, a clear majority against it. But under the European Union’s second reading rules, rejecting a law at this stage requires an absolute majority of all 720 seated members, 361 votes, not just a majority of those who show up. Because 314 fell 47 votes short of that threshold, the law passed anyway. Absences and abstentions were counted as if they supported the measure, so Chat Control passed, as one commentary put it, “without a majority of its members ever voting for it.”

What “Chat Control” Actually Does

The law authorizes, but does not require, messaging and email providers to scan private communications using three methods: matching images against databases of known abuse material, using artificial intelligence to flag previously unseen material, and analyzing text conversations for patterns associated with grooming. Supporters have called this “voluntary CSAM detection,” but critics describe it more bluntly. The advocacy group FightChatControl said the effect is that “every photo, every message, every file you send may be automatically scanned, without your consent or suspicion.” The group added, “This is not about catching criminals. It is mass surveillance imposed on all 450 million citizens of the European Union.”

That phrase, warrantless mass scanning of private messages, describes exactly what critics find objectionable. It does not target people who are suspected of a crime. It scans everyone’s communications by default, on the theory that some small fraction of that traffic might contain illegal material. This is the same basic difference that separates ordinary policing from a general search: one starts with evidence and probable cause, and the other starts by assuming that the entire population needs to be checked.

End-to-End Encryption and What It Protects

End-to-end encryption is a method of securing digital communication so that only the sender and the recipient can read what was sent, not even the company running the app. Signal, WhatsApp, and iMessage, when not backed up to iCloud, all rely on this by default, and because the platform cannot read the message, it cannot scan it either. Lawmakers adopted an amendment this week exempting encrypted services from the new law. Pirate Party MEP Markéta Gregorová, who put forward that amendment, called its passage “a bittersweet victory,” adding that “voluntary mass scanning unfortunately passed” anyway. Critics note the exemption mostly restates the obvious, since encrypted apps were never technically scannable under this law to begin with. The bigger threat is a separate, still unfinished proposal, Chat Control 2.0, which could require even encrypted platforms to scan messages on a user’s own device before encryption is applied.

Who Pushed It, and Who Fought It

European Commission President Ursula von der Leyen backed the measure, along with her European People’s Party, the largest bloc in Parliament. Party vice chair Tomas Tobé said the group “fought hard to protect children from sexual abuse online and we will never stop doing so.” Google, LinkedIn, Microsoft, Snapchat, TikTok, and Meta issued a joint statement urging lawmakers to move forward with scanning.

Opposition came from a wide and unusual mix of liberal, left, and right wing parties. Former MEP Patrick Breyer said flatly that “trying to protect children with suspicionless mass surveillance is like frantically mopping the floor while the faucet is still running.” He compared it to “indiscriminately opening everyone’s physical mail.” MEP Fidias Panayiotou asked, “What kind of democracy is this?” after Parliament was made to vote on the same rejected measure repeatedly until it passed.

Does the Scanning Actually Work?

The evidence is far from settled. Germany’s federal police agency reports that 48 percent of the alerts this kind of scanning generates turn out not to be criminally relevant. Breyer, citing official data, says 40 percent of the investigations triggered by these flags end up targeting minors rather than abusers, and that roughly 99 percent of Meta’s reports involve material police already had. The European Commission’s own review found that artificial intelligence classifiers produced false positives in as many as one out of every five flagged cases.

Why This Matters

Mass surveillance of an entire population is a profound breach of privacy. It treats every person as a suspect first and a citizen second, reversing the presumption of innocence that free societies are supposed to guarantee. That is precisely why the United States Constitution requires a warrant, based on individualized suspicion, before the government can search a person’s private communications. That requirement exists because history has shown what happens when governments are allowed to watch everyone just in case. The European Union has now chosen a different path, one where the burden falls on ordinary people to prove they have nothing to hide rather than on the state to show cause before it looks. Whatever the intentions behind it, that is a grave development, and one worth watching closely as the fight over the permanent version of this law resumes in September.