Europe revives law allowing big tech to scan for CSAM

The European Parliament has voted to bring back a rule giving big tech permission to scan users’ messages to hunt for child sexual abuse material (CSAM), a process that critics call Chat Control.

Thursday’s vote occurred the day before summer recess and was the product of an unusual legislative procedure requiring an absolute majority to kill the provision. Because absolute majority votes count all lawmakers who are not present as yeses, the measure passed even though more present members opposed it than supported it.

The law allowing the voluntary scanning, which dates to 2021, expired in April after Parliament could not come to agreement about how to move forward amid a privacy outcry. Some lawmakers and other officials, including Parliament President Roberta Metsola, had urgently prioritized renewing the rule (which doesn’t allow scanning on encrypted platforms like Signal).

Big tech continued the scans even after the law lapsed, but European officials cautioned against doing so without legal protection.

Now that the ruling has given firms like Google, Microsoft and Meta clear direction and legal cover to continue the CSAM scans until 2028, critics say privacy in Europe is under siege.

Use of the procedural move to require an absolute majority vote on the eve of summer recess is all the more disturbing, critics say, because Parliament rejected the same measure three months ago under normal circumstances.

The “highly politicised procedural efforts” were fueled by Metsola and are an unprecedented tactic, according to a blog post from Rand Hammoud of Europe’s Center for Democracy and Technology. The post criticized lawmakers for “overstepping Parliament’s own mandate and previous vote.”

Even as the two sides spar over Thursday’s vote, a much bigger battle is being fought over the new law, which insiders call Chat Control 2.0.

In its most extreme form, 2.0 could force service providers to scan conversations and hosted content, including in end-to-end encrypted communications, Simeon de Brouwer, policy adviser at the advocacy group European Digital Rights, said via email.

Lawmakers have been negotiating a permanent framework since November 2023 but have made little progress.

Law enforcement officials have argued strongly in favor of allowing the scans on a permanent basis. When the law lapsed in April, Catherine De Bolle, the executive director of Europol, issued a statement saying that “enabling online service providers to continue detecting and reporting suspected CSAM to the competent authorities is vital for the protection of children.”

But De Brouwer says the tradeoffs are too high.

Chat Control allows tech companies to “snoop without a warrant, with little to no oversight, and with no legal basis, on millions of conversations,” he said.