The European Parliament voted on Thursday to restore temporary rules permitting major online platforms to scan for and remove child sexual abuse material, while carving out a significant exemption for end-to-end encrypted services - a compromise that satisfies neither side of one of digital policy's most divisive disputes. The vote in Brussels keeps the pressure on EU member states, which now have three months to decide whether to accept the Parliament's amendments. The stakes extend well beyond child protection: the outcome will shape how Europe regulates the fundamental tension between platform accountability and communications privacy.
What the Vote Actually Decided
The reinstated rules revive a temporary framework that was in place from 2021 until April of this year. That regime exempted platforms from strict EU privacy law provisions in order to allow voluntary scanning for known and new child sexual abuse imagery, as well as for evidence of grooming. Thursday's vote brings those permissions back - but with a critical modification.
Services that rely on end-to-end encryption, including WhatsApp, Telegram, and Signal, would be excluded from scanning obligations under the amended text. End-to-end encryption means that messages are readable only by sender and recipient; the platform itself cannot access content in transit. Requiring such services to scan messages would either require breaking that encryption architecture or building a parallel surveillance layer - both of which privacy advocates argue would fundamentally compromise the security guarantees that end-to-end encryption provides.
Marketa Gregorova, a member of the European Parliament from the Pirate Party, acknowledged the result as a partial win. "Protecting encryption was one of our priorities, and I am therefore glad that we managed to secure an absolute majority for an amendment that at least preserves encryption," she said, adding that she remained troubled by what passed alongside it: "At the same time, however, voluntary mass scanning unfortunately passed."
The Longer Dispute Behind the Vote
Thursday's action is a stopgap, not a resolution. The European Commission proposed permanent legislation on child sexual abuse material in 2022, but that effort has stalled amid persistent disagreement between member states and the Parliament over the scope of detection obligations. Negotiations broke down again last month, leaving the two sides unable to close the gap on a lasting framework.
The disagreement is structural. Child safety organizations and law enforcement advocates argue that voluntary measures have proven insufficient and that platforms - particularly encrypted messaging services - have become vectors for the distribution of abuse material and the coordination of grooming. On the other side, digital rights groups, security researchers, and privacy-focused lawmakers contend that any scanning mechanism capable of detecting content within encrypted communications constitutes a form of mass surveillance, regardless of its stated purpose.
Big Tech companies have lobbied against the broadest versions of the proposed rules. Their objections center on requirements that would extend to messaging services, app stores, and internet access providers - obligating them not just to remove known illegal content but to proactively detect new material and flag grooming behavior. The technical and legal implications of that scope are significant: proactive detection of unknown content requires continuous, automated analysis of communications at scale.
Encryption at the Center of the Policy Debate
The exemption for encrypted services matters beyond this particular vote. It reflects a broader and unresolved policy question that regulators across multiple jurisdictions are grappling with: whether governments can mandate access to encrypted communications for law enforcement or child protection purposes without undermining the security infrastructure that protects ordinary users - including journalists, dissidents, medical patients, and financial transactions.
Encryption works precisely because it does not make exceptions. A backdoor or client-side scanning mechanism that allows one party to access message content can, in principle, be exploited by others - including foreign intelligence services, criminal actors, or authoritarian governments seeking access to activist communications. Security researchers have argued this point consistently: there is no technically credible way to build a surveillance capability that is accessible only to trusted authorities and invisible to adversaries.
The Parliament's decision to protect encryption in this round does not settle the question permanently. The temporary rules will again create pressure for a permanent solution, and EU countries now hold the next procedural move. If member states push back on the Parliament's encryption exemption, the two institutions will need to find a negotiated position - and the same fault lines that prevented agreement last month will still be present.
What Comes Next
The three-month window for EU member states to respond gives governments time to assess whether the Parliament's version of the rules is acceptable or whether they will push for changes. If significant disagreement persists, further negotiations between the Parliament and the Council of the EU - the body representing member governments - will be required before any permanent legislation can be adopted.
The broader European framework for platform content moderation is already evolving rapidly, with the Digital Services Act establishing new obligations for large platforms. The child sexual abuse material regulation represents a harder case precisely because it seeks to extend obligations into spaces - encrypted private communications - that the Digital Services Act largely did not touch. Resolving that boundary will require political agreement on questions that are, at their core, not purely technical: how much privacy European citizens are prepared to trade for enforcement capacity, and who should be trusted to operate the mechanisms that bridge that gap.
