EU Parliament Votes Down Extension of CSAM Scanning Mandate
The European Parliament has rejected an extension of rules requiring technology platforms to scan user content for child sexual abuse material (CSAM), in a significant vote that 311 members of parliament (MEPs) voted against. The decision preserves current limitations on scanning obligations and deals a major setback to controversial proposals that would have required platforms — including those offering end-to-end encrypted messaging — to scan private communications.
The vote came despite strong support for the extension from law enforcement agencies, children's rights organizations, German Chancellor Friedrich Merz, several European commissioners, and major technology companies.
What Was Being Voted On?
The European Parliament was considering an extension of existing temporary CSAM scanning derogations — rules that allow platforms to voluntarily scan for CSAM content as an exception to the EU's ePrivacy Directive. These derogations were set to expire, and the vote was on whether to extend them.
The broader legislative context involves the EU Chat Control proposal (officially "Child Sexual Abuse Regulation"), which has been a flashpoint for debate over:
- End-to-end encryption (E2EE) — Many privacy advocates argue that CSAM scanning of encrypted messages is technically incompatible with strong E2EE
- Mass surveillance concerns — Critics argue the scanning infrastructure could be repurposed or expanded
- Child protection — Proponents argue the scanning is essential to detect and disrupt CSAM distribution networks
Why 311 MEPs Voted Against
The MEPs opposing the extension cited several concerns:
Privacy and encryption integrity: The proposed scanning mechanisms — particularly client-side scanning (CSS) — would require processing message content before or after encryption, effectively creating a backdoor. Security researchers, cryptographers, and privacy organizations widely view CSS as incompatible with the security guarantees of E2EE systems.
Proportionality concerns: Critics argued that mandatory scanning of all users' communications — the vast majority of whom are law-abiding — constitutes disproportionate surveillance and violates fundamental rights under EU law.
Technical efficacy questions: Research has shown that CSAM detection systems carry significant false positive rates. Mandatory scanning at scale could generate enormous numbers of incorrect flagging incidents, raising due process concerns.
Chilling effects: Journalists, lawyers, healthcare professionals, and activists rely on E2EE for confidential communications. Mandatory scanning could chill legitimate protected speech.
Reactions
Law enforcement and child protection groups expressed disappointment, arguing that the vote would hamper investigations into child exploitation networks and allow CSAM to proliferate on encrypted platforms.
Privacy advocates and digital rights organizations welcomed the vote as a defense of fundamental rights and encryption integrity. The European Digital Rights (EDRi) network praised the outcome.
Technology companies that had backed the extension — including several major platforms with existing CSAM scanning programs — noted the rejection creates uncertainty about the continued legality of voluntary scanning under EU law.
What Happens Next?
The rejection of the extension does not end the debate. The broader Chat Control / CSAM Regulation proposal remains active in the legislative process, and the European Commission may bring forward revised proposals.
Key developments to watch:
- Revised Commission proposal — The Commission may reframe the legislation to address proportionality and encryption concerns
- Council of the EU — Member state governments, many of which supported scanning mandates, will continue to push for regulation
- Legal challenges — The European Court of Justice may ultimately rule on whether content scanning mandates comply with the EU Charter of Fundamental Rights
- International context — Similar debates are active in the UK (Online Safety Act), US (EARN IT Act), and other jurisdictions
The Encryption at the Center of the Debate
The CSAM scanning debate is fundamentally a proxy for a larger policy question: should governments be able to mandate access to encrypted communications?
Current E2EE implementations in platforms like Signal, WhatsApp, and iMessage are designed so that only the sender and recipient can read message content — not the platform, not law enforcement, and not governments. Any technical mechanism for scanning E2EE messages necessarily weakens this guarantee.
Security researchers, including the authors of a widely cited 2021 paper "Bugs in our Pockets", have argued that client-side scanning creates systemic vulnerabilities exploitable by state actors and malicious attackers beyond their intended use.
Key Takeaways
- The European Parliament voted 311 against extending CSAM scanning derogations for tech platforms
- The vote preserves current limitations but does not resolve the broader legislative debate over the Chat Control proposal
- The decision is a win for E2EE preservation but disappointment for law enforcement and child protection advocates
- The legislative fight continues — expect revised proposals and ongoing debate at EU level
- The outcome reflects the deep tension between child protection and digital privacy that defines modern encryption policy debates