More MEPs voted against Chat Control than for it. It advanced anyway. And it's still not law. Here's what actually happened. • 314 MEPs voted to reject it, 276 to keep it. Rejection failed anyway: second reading requires 361 votes, an absolute majority of all 720 seats, not of those voting. An absent MEP counts the same as a yes. • An amendment limiting scanning to people under judicial suspicion won 322–255, more support than the extension itself. Also killed by the threshold. • The ONLY thing that cleared 361 all day: two amendments protecting end-to-end encryption, at 369 and 362 votes. One passed by a single vote. On the hardest bar in the chamber, the only consensus was: don't touch encryption. • And crucially: because Parliament amended the text, it is NOT law yet. Under Art. 294(8) TFEU it returns to the Council, which has until ~October 9 to accept all amendments — or trigger conciliation, where Parliament decides by simple majority and the 361 threshold disappears. If conciliation fails, the act falls entirely. Targeted surveillance won the room. Mass surveillance won the procedure. And the procedure isn't over. For the next three months, the decision sits with national governments, not Strasbourg. Italy's government formally warned the Council against private mass surveillance; then voted for the text in that same Council (🫠). Your capital has a position too. Now is when it can change. Watch the calendar.

Yesterday the EU Parliament voted on Chat Control. 314 MEPs voted to reject it. 276 voted to keep it. A clear majority of those who voted said no, and it wasn’t enough. The 360-vote threshold did exactly what it was designed to do. Whatever the outcome, don’t look away now. Chat Control 1.0 is NOT mandatory scanning. It’s the expired ePrivacy derogation, the legal basis for platforms that choose to scan private messages. Voluntary. Bad? A lot. Rejected in March. Expired in April. Resurrected in July via urgent procedure, on the last day before summer recess, when blocking it took 361 votes and every absent MEP counted as a yes. They didn’t win the argument. They changed the rules. Why? Because the Council needed it to buy time and leverage for the real fight: Chat Control 2.0 (CSAR). CSAR detection orders would let authorities force every platform to scan your private communications. Still stuck in negotiations. Still not law. Still stoppable. That’s exactly why this is not the moment to tune out. This is the moment they’re counting on you to tune out. So please, stay loud. The real battle is still ahead.

Why am I so fixated on Chat Control? Because saying that “encryption remains in place” is one of the most dishonest statements I’ve ever heard. Client-side scanning checks your content ON YOUR DEVICE, before encryption takes place. The padlock is intact. They’re simply searching your bag before you put anything inside it. E2EE ends up protecting the transmission, not the communication. Your own device becomes the informant. And what about detection technology? The Commission’s own evaluation of voluntary scanning found false positive rates of up to 20% for AI-based image detection. One in five flagged conversations: it wasn’t CSAM. Now scale that to billions of messages. Over 800 cybersecurity researchers have warned the European Parliament that the error rates are unacceptable and that targeted tools already exist. In tech policy, that level of scientific consensus against a proposal is almost unheard of. Even the Council’s own Legal Service says that access to private communications without suspicion violates Article 7 of the Charter. So what? So they intend to approve it. → fightchatcontrol.eu