Child porn law sparks privacy row in European Parliament

In the end, Fidias Panayiotou was the only Cypriot MEP who voted to reject the temporary reinstatement of ‘Chat Control’ legislation, which nevertheless passed with what can only be described as Byzantine-like procedures. With the law now in effect until April 2028, it marks a setback for privacy advocates.

Chat Control is the informal term for the EU’s Child Sexual Abuse Regulation (Csar).

Under the guise of combating child pornography, the EU proposes to force every messaging platform – WhatsApp, iMessage, Messenger, Instagram, Telegram, Signal, Gmail and all communication apps – to implement government-mandated scanning technology that will analyse every private communication with artificial intelligence and report suspicious content to authorities.

One attorney and privacy advocate who previously wrote in the Cyprus Mail said this surveillance overreach can lead to a host of nightmarish scenarios – innocent photos of kids sent by parents could bring the police knocking at their door; pictures shared by teenagers get flagged by the AI, incapable of distinguishing context and intent. And so forth.

It’s not just about the violation of privacy as a matter of principle; it’s also the blanket implementation of it.

On July 9 a vote took place at the European Parliament. The proposition being voted on was whether to reject the Council’s position. And the Council’s position was to reinstate a derogation from the ePrivacy Directive – in other words, to keep Chat Control.

Under the rules, an absolute majority was needed for the proposition to pass. Meaning that of the 720 MEPs, at least 361 had to vote in favour of the proposition – to reject the temporary reinstatement of Chat Control until 2028.

Previously, the European Parliament had rejected the extension of Chat Control at a first reading in March. The derogation lapsed on April 3. Then on July 2 the Council adopted its position, sending the file to a second reading.

Next, on July 7 the European People’s Party (EPP) invoked Rule 170(6) to fast-track the file past committee, in the last sitting before recess. European Parliament President Roberta Metsola put the file back on the table at the request of the EPP.

And so, on July 9 – the last session of the European Parliament before recess, when a number of MEPs had already left town – the vote took place.

In this situation, 314 MEPs voted to reject the Council position – falling short of the 361-vote absolute majority required at second reading to reject or amend.

Bottom line: Chat Control is back.

“The deeper worry, for me, is what the sequence teaches. A proposal can be voted down at first reading and still return through a Council position, a second-reading threshold can convert absence into consent and an urgency motion can remove the committee stage days before recess,” Andreas Shialaros, a Cypriot lawyer who’s been tracking the issue closely for some time, said.

“None of that is unlawful, and that is rather the point. The machinery contains enough legitimate routes that a determined institution can simply keep going until the arithmetic falls the right way. Opponents have to win every time, proponents need to only win once.”

How did the six Cypriot MEPs vote? It turns out that only Fidias Panayiotou (Direct Democracy-Independent) voted to reject extending Chat Control legislation.

President of the European Parliament Roberta Metsola

Elam’s Geadis Geadi (European Conservatives and Reformists) and Disy’s Michalis Hadjipantela (EPP) voted to keep Chat Control.

The other three Cypriots – Loucas Fourlas (Disy-EPP), Giorgos Georgiou (Akel-The Left), and Costas Mavrides (Diko-Progressive Alliance of Socialists and Democrats) – either abstained or were not present.

There’s more. On Wednesday, EU ambassadors approved the written procedure for the temporary framework, derogating from the bloc’s rules on the privacy of electronic communications to combat the spread of child pornography.

Written procedures are normally employed for relatively non-controversial files and allow member states to give their voting preference without a formal meeting.

And a day later, the file was confirmed as adopted with 25 governments in favour; only one voted against while another abstained.

In other words, the member states confirmed the text as it passed in the European Parliament on July 9, including a last-minute amendment removing end-to-end encrypted messaging services such as WhatsApp and Signal from its scope.

At this point, it’s useful to explain what exactly passed through – or engineered, some might say – the European Parliament.

There is no one proposed Chat Control law – there are two in fact, and they’re moving through EU institutions in parallel.

According to an anti control website, Chat Control 1.0 is what went through the European Parliament earlier this month. It’s the so-called ‘temporary’ law, now in force until 2028.

This is a temporary derogation from the ePrivacy Directive that allowed (but did not require) providers to scan private messages of unsuspected users for potential child sexual abuse material. Here, scanning is not mandatory. In practice, it’s used mainly by unencrypted US services such as Gmail, Facebook/Instagram Messenger, Skype, Snapchat, iCloud Mail, and Xbox. Also, it doesn’t include end-to-end encrypted messages, although providers could deploy client-side scanning under this law.

Then there is Chat Control 2.0 – the permanent proposal for Csar. It’s a proposed permanent regulation that would make detection and reporting of child sexual abuse material a legal requirement for digital platforms.

The original proposal mandated scanning of private communications; the Council’s 2025 position shifted to “voluntary” suspicion-less detection. The European Parliament’s position is that scanning of private communications must be limited to individual users or a specific group of users suspected of links to child sexual abuse, and that a court order is required; implementation of the order would then be mandatory. Potentially, it could include end-to-end encrypted messages.

On the permanent proposal, five trilogue rounds have failed to produce a deal. The supposedly final trilogue on June 29 collapsed over suspicion-less scanning; negotiations continue under the Irish presidency of the Council of the European Union.

An EU trilogue is an informal negotiation meeting that brings together the European Parliament, the Council of the European Union, and the European Commission. Its goal is to create a quick compromise on new laws.

“Any scanning of the content of private communications must be limited to specific suspects,” MEP Ignazio Marino (Greens/EFA/Italy) told Euronews.

“No child is helped by a law that will be annulled by the Court of Justice,” he added.