The European Parliament has drawn a clear line between fighting child sexual abuse online and dismantling the privacy architecture that protects all digital communications. In a vote on 9 July, MEPs adopted a series of amendments to the Council's position on a temporary derogation from the ePrivacy Directive - explicitly calling for end-to-end encrypted communications to be excluded from the scope of any automated content scanning by service providers. The decision advances a modified text to the Council, which now has three months to accept, reject, or negotiate a compromise.
What the Derogation Actually Does - and What Parliament Changed
The derogation at issue is a transitional measure, not permanent law. It creates a temporary exception to the European rules on the confidentiality of electronic communications, permitting messaging platforms, email services, and similar providers to voluntarily scan, flag, and remove child sexual abuse material and instances of grooming. The Council of the EU had proposed extending this arrangement until April 2028, bridging the gap before permanent legislation on child sexual abuse online enters force.
Parliament did not reject the extension outright - proposals to block the Council's position entirely failed to reach the required absolute majority of 360 votes. Instead, MEPs amended the text. The most consequential change is Amendment 30, which would exclude from the derogation's scope any communications protected by end-to-end encryption: systems in which data is encrypted on the sender's device and can only be decrypted by the intended recipient, with no readable intermediate copy accessible to the service provider or any third party.
The practical consequence is significant. Under the Parliament's amended position, platforms that offer end-to-end encryption - as many widely used messaging applications now do - could not be required or permitted to scan message content as part of this derogation, even voluntarily.
Why Encryption Is the Central Fault Line
End-to-end encryption is not simply a technical feature. It is the mechanism that makes mass surveillance of private communications structurally impossible without either breaking the encryption itself or installing client-side scanning tools on users' devices before content is encrypted. Both approaches have been fiercely contested by security researchers, civil liberties organisations, and much of the technology industry, precisely because any such mechanism - however narrowly designed - introduces a systemic vulnerability that cannot remain exclusive to one purpose or one actor.
This is the core tension the Parliament's vote reflects. Scanning encrypted communications for illegal content is, by definition, a form of decryption or pre-encryption interception. Proponents of such measures argue that the gravity of child sexual abuse justifies the intrusion. Critics - and the Parliament's amended position leans toward them on this specific point - contend that weakening encryption for one purpose weakens it for all purposes: for journalists, abuse survivors, political dissidents, healthcare workers, and ordinary citizens who depend on the confidentiality of their digital communications.
MEP Gaetano Pedullà, representing the Five Star Movement, was direct in his assessment: "Under the pretext of protecting children, some governments would in fact like to secure a powerful tool for the surveillance and control of citizens." MEP Carlo Fidanza of Fratelli d'Italia framed it as a matter of legal principle: "Protecting children and combating online predators cannot mean abandoning the principles of the rule of law: citizens' security also depends on safeguarding the confidentiality of their communications."
The Broader Legislative Landscape
The vote does not resolve the underlying policy debate - it repositions Parliament within it. The derogation is explicitly temporary, and the European Union is simultaneously working on a permanent legislative framework to combat child sexual abuse online. The European Parliament and Council have already reached agreement on updating the relevant criminal law provisions, meaning the definitional and prosecutorial dimensions of the issue are advancing separately.
What remains unresolved is the surveillance mechanism question: what technical means can service providers lawfully use, and under what conditions, to detect illegal content in private communications? The Parliament's amendment signals that, at least for end-to-end encrypted channels, that question cannot be answered by simply extending a derogation and hoping the permanence problem resolves itself later.
If the Council declines to accept Parliament's amendments within three months, a formal conciliation procedure begins - a structured negotiation between the two institutions aimed at producing a jointly agreed text. That process will likely bring the technical and civil liberties arguments back to the surface, with pressure from member state governments who have, in various national contexts, pushed hard for expanded access to encrypted communications in criminal investigations.
What the Vote Signals for Digital Rights in Europe
The Parliament's position, while not final, carries real weight as a statement of institutional principle. It affirms that the protection of end-to-end encryption is not an obstacle to child safety policy but a precondition for legitimate digital governance - one that cannot be quietly traded away through the incremental extension of temporary exceptions.
The outcome also reflects a growing consensus in the technical and policy communities that backdoors and scanning mandates, regardless of how they are framed, represent a categorical threat to communications security. Once an access mechanism exists in a system, its scope cannot be reliably limited by political intention alone. History offers no shortage of examples of surveillance tools adopted for one stated purpose being extended to others over time.
For European citizens, the immediate effect is that the amended text - if accepted - preserves the confidentiality of encrypted messaging for now. The longer-term question is whether the permanent legislation under development will hold the same line, or whether the conciliation process ahead will quietly dilute it. That battle is far from over.
