Chat Control 1.0 Extended to 3 April 2028: What the 9 July Vote Means for Boards

On 9 July 2026, the European Parliament's second-reading vote opened the path for extending Regulation (EU) 2021/1232, the "Chat Control 1.0" derogation from the ePrivacy Directive, until 3 April 2028. A motion to reject the Council's position drew 314 votes against 276, with 17 abstentions: a relative majority, short of the 361-vote absolute majority that Article 294(7) TFEU demands at second reading. As a result, providers of number-independent interpersonal communications services, WhatsApp, Messenger, Gmail, Microsoft Teams and comparable platforms, stand to regain a legal basis for voluntarily scanning private messages for known child sexual abuse material.

What the regulation says

Regulation (EU) 2021/1232 derogates from Articles 5(1) and 6(1) of Directive 2002/58/EC, the confidentiality-of-communications and traffic-data rules of the ePrivacy framework. Inside that carve-out, providers of number-independent interpersonal communications services may voluntarily deploy technologies to detect known child sexual abuse material and the solicitation of children, remove the content, and report it to law enforcement and to organisations acting in the public interest. Article 3 of the regulation makes the derogation conditional: a documented data protection impact assessment, prior consultation of supervisory authorities under Articles 35 and 36 of the GDPR, deployment of the least privacy-intrusive technology available, human oversight of processing, effective complaint and judicial-redress mechanisms, strict retention limits, and annual public transparency reporting.

The derogation expired on 3 August 2024, gained a first extension to 3 April 2026 through Regulation (EU) 2024/1307, and lapsed on that date after negotiations on a permanent framework stalled. The Commission's proposal of 19 December 2025, procedure 2025/0429(COD)revives the regime and extends application until 3 April 2028, a period the Commission describes as strictly necessary to conclude the long-term framework known as Chat Control 2.0. The European Data Protection Supervisor scrutinised the proposal in Opinion 7/2026 of 16 February 2026, underlining the exceptional character of any derogation from the confidentiality of communications.

The procedural mechanics decided the outcome. At second reading, Parliament rejects or amends a Council position by an absolute majority of its component members: 361 of 720 votes. The rejection motion of 9 July 2026 gathered 314 votes, more than the 276 cast in defence of the text, and short of the threshold all the same. MEPs then adopted one substantive amendment, excluding "communications to which end-to-end encryption is, has been or will be applied" from the law's scope, and forwarded the amended position to the Council. A plurality of the chamber opposed the extension; the extension advanced regardless. That asymmetry is the governance story: second-reading arithmetic converts abstentions and absences into votes for the status quo the Council wrote.

Who must act and by when

The Council now holds a three-month window to approve Parliament's amended position; approval brings the extension into force upon publication in the Official Journal, which points to autumn 2026 as the planning baseline. Rejection of the amendments would trigger conciliation under Article 294(10) TFEU, a scenario boards should price in, given that the encryption carve-out touches the Council's core position.

Directly regulated entities: providers of number-independent interpersonal communications services offered in the EU, consumer messengers alongside enterprise channels such as Microsoft Teams and WhatsApp Business. Scanning stays voluntary; a provider that opts in must satisfy every Article 3 condition before deployment. Parliament's end-to-end encryption exclusion, as adopted, removes E2EE channels from the derogation's scope entirely, a line the Council may contest during its three-month review. Processing devoid of a legal basis also exposes providers to penalties under Article 83 GDPR, up to 4% of worldwide annual turnover.

The interim gap deserves separate attention. Between 3 April 2026 and the extension's entry into force, voluntary scanning lacked an EU-level legal basis: Articles 5(1) and 6(1) of the ePrivacy Directive applied in full. Providers that maintained detection during those months operated in a zone of legal exposure that varies by Member State implementation. Legal teams should audit provider conduct across that window and document the finding, supervisory authorities and litigants can reach back to it.

Indirectly exposed: every enterprise whose employees, counsel, or customers communicate over in-scope platforms. Provider-side scanning of hosted business communications raises confidentiality questions for privileged correspondence, trade secrets, and regulated data. The vote count, a chamber plurality on record against a text that becomes law regardless, also signals durable political contention: further scope changes are probable when Chat Control 2.0 negotiations resume ahead of the 2028 expiry.

The board-level decision

One action belongs on the next risk-committee agenda: a board-ratified communications-channel exposure review. The review should map which corporate messaging channels fall within the derogation's scope, record whether each provider has opted into voluntary detection under Article 3, verify the encryption status of channels carrying privileged or trade-secret content, and set routing policy accordingly. General Counsel should attach two triggers: first, the Council's decision within its three-month window updates the review automatically; second, entry into force of the extension activates a refresh of the data protection impact assessment for any in-scope internal platform. Companies that complete this decision trail before Official Journal publication will face supervisory and litigation scrutiny from a position of demonstrable diligence, and will hold a documented answer when the permanent framework arrives with obligations that reach beyond voluntary participation.