The European Union's most contested surveillance proposal just cleared its highest hurdle in the strangest way possible: a majority of lawmakers voted against it, and it advanced anyway. On July 9, 2026, the European Parliament held an emergency vote on whether to reject the Council's revived Chat Control plan to scan private messages for child sexual abuse material. More MEPs voted no than yes - but not enough of them, and the rules moved forward.
A rejection that was not enough
The numbers tell the story. The motion to reject the Council's position drew 314 votes in favor, 276 against, and 17 abstentions. On any ordinary day, 314 versus 276 is a clear defeat for the measure. But this was a second-reading vote, where blocking the Council requires an absolute majority of all sitting MEPs - 361 votes. Opponents fell 47 short.
The result is a law that passed by default. The extension of the voluntary scanning regime now stands, not because most voting lawmakers backed it, but because procedure demanded a supermajority to stop it and that bar was not met.
The encryption carve-out
There was one genuine win for privacy. In separate votes the same day, Parliament adopted two amendments - passing with 369 and 362 votes - that explicitly exclude end-to-end encrypted services from the scope of scanning. Those amendments did clear the 361-vote threshold.
In practice, this means WhatsApp, Signal, and Telegram are formally placed outside the reach of Chat Control's voluntary detection track. Encryption held where the broader rejection failed. The carve-out matters because scanning an encrypted message means breaking the encryption for everyone - the core objection privacy groups have raised from the start, which we explained in our breakdown of how Brussels planned to end private messaging.
How the EU got here
This vote did not come out of nowhere. Just days earlier, the Council revived the file through an administrative shortcut, a move we covered when the Council pushed Chat Control forward via written procedure, bypassing open Parliament debate. That followed months of deadlock, including the collapse of talks when the fifth trilogue failed and encryption held - for the moment.
Each round has followed the same pattern: a broad scanning mandate pushed by the Council, resistance in Parliament, and a fragile compromise that keeps the fight alive rather than ending it.
What happens next
The amended text now returns to the Council, which has three months to decide. It can accept all of Parliament's amendments - in which case the regulation, including the encryption carve-out, is formally adopted, most likely in October 2026. Or it can reject part of them, which triggers a Conciliation Committee and months of further negotiation.
In other words, the encryption exclusion is not yet safe. It survives only if the Council signs off on it unchanged. If ministers push back, the carve-out that protects Signal and WhatsApp could be reopened.
This uncertainty is exactly why interest in privacy tools rises with every Chat Control vote. A VPN does not decrypt or scan anything - it encrypts a user's connection and hides their location from an internet provider, which is a different layer from message-content scanning. But the same instinct drives both: when lawmakers signal that private communication is negotiable, people look for ways to keep their traffic and their messages to themselves.
