EU Parliament Revives Voluntary CSAM Scans to 2028 via Absolute Majority Loophole

The vote renewed the 2021 interim regulation that lapsed in April. Big-tech firms had continued hashing and reporting despite the lapse; the new measure supplies explicit legal cover only for non-encrypted services. Parliament had rejected the identical text three months earlier under ordinary procedure. Roberta Metsola’s office pressed for the procedural reset, a move CDT’s Rand Hammoud called an overstep of prior parliamentary mandate.

Evidence shows the pattern: Europol’s Catherine De Bolle issued an immediate statement framing continued detection as “vital,” while EDRi documented that client-side scanning language remains live in the Chat Control 2.0 trilogue drafts. No technical mandate for E2EE platforms exists yet, but the voluntary window normalizes bulk perceptual hashing without warrants or independent oversight.

The operational significance is the precedent for platform liability. Once scanning infrastructure is re-authorized and funded, extending it to encrypted messengers becomes a regulatory tweak rather than a new capability. Negotiations resume in September; the current text still contains the clause allowing detection orders on E2EE services if voluntary measures are deemed insufficient.

Next milestone is the September trilogue deadline. If no blocking minority forms before the 2025 review, the voluntary regime converts into a de-facto scanning obligation with 2028 as the enforcement trigger.