Chat Control 1.0 Passed Despite More “No” Than “Yes” Votes. Here’s What Actually Happened.

This was not a standard legislative vote requiring a simple majority of votes cast. Because of the specific procedural stage of this legislation, rejecting the proposal required an absolute majority of all Members of the European Parliament—currently 361 votes.

Although 314 MEPs voted against the proposal, that number fell short of the required threshold. As a result, the proposal was considered approved.

The adopted measure does not introduce mandatory scanning of all private messages. Instead, it extends the existing temporary legal framework that allows online service providers to voluntarily detect and report child sexual abuse material (CSAM) in certain types of communications until 3 April 2028.

This primarily applies to communications that are not protected by end-to-end encryption, such as:

• traditional email services
• cloud storage
• certain direct messaging services
• other communications where providers can access message contents

Importantly, the Parliament maintained language excluding end-to-end encrypted communications from this voluntary scanning framework. For a precise definition of what that means in practice—and how it differs from ordinary transport encryption—see our guide on what end-to-end encryption actually is.

Many researchers and civil liberties organisations opposed the extension—not because they oppose protecting children, but because they question whether this approach achieves that goal without creating significant risks. Our earlier article on why Europe's cryptographers keep warning about Chat Control explains the broader technical objections in depth.

While this week's vote has attracted significant attention, many experts believe the larger debate is still ahead. The proposal commonly referred to as Chat Control 2.0 aims to establish a permanent legal framework for detecting CSAM online.

Unlike the temporary extension adopted this week, discussions around Chat Control 2.0 have repeatedly included proposals that could affect end-to-end encrypted communications. That is where the debate becomes considerably more significant—and where the warnings in our cryptographers' briefing on Chat Control matter most.

Private communication is built on a simple principle: if a service cannot read your message, it cannot scan it, analyse it, sell it, or accidentally expose it. PrivateNote was designed around that idea.

When you create a note, encryption happens directly inside your browser. The encryption key never reaches our servers. We store only ciphertext. Without the key—which remains entirely under your control—the contents of your note are mathematically unreadable to us.

That design is not about avoiding responsibility. It is about ensuring that your private communication remains exactly that: private. Whether you are sharing passwords, legal documents, financial information, business secrets, or personal conversations, privacy should not depend solely on trusting the service provider. It should be enforced by cryptography.

For a step-by-step view of how browser-side encryption works in practice, see How PrivateNote works. For sharing short-lived secrets without leaving them in a permanent chat thread, one-time secret links are often a better fit than messaging apps—even encrypted ones.

Reasonable people can disagree about how society should combat online child abuse. Protecting children is unquestionably one of the most important public interests. The difficult question is how to achieve that goal without undermining the security and privacy infrastructure relied upon by journalists, businesses, lawyers, healthcare providers, activists, and ordinary citizens every day.

As discussions continue around Chat Control 2.0, this balance between public safety and fundamental privacy rights will remain one of the defining technology policy debates in Europe. Whatever one's position, one thing is certain: the future of encrypted communication will increasingly be decided not only by cryptographers and software engineers—but also by legislators.