The bill now moves to the EU member states, which will deliberate on its approval. This process is expected to reignite intense debate among national governments, privacy commissioners, and technology companies. While the Parliament's unexpected revival suggests strong political will from certain factions, the inclusion of the encryption carve-out means the discussion will likely focus on the practicalities and effectiveness of scanning non-encrypted communications, and the ongoing viability of the exemption for encrypted platforms. Separately, negotiations for a permanent, broader regulation on online child sexual abuse material continue in parallel, indicating that this temporary measure is just one piece of a larger, unresolved legislative puzzle.
Image: courtesy of Thenextweb
EU Parliament's 'Zombie' Bill Returns: What the Child Abuse Scanning Revival Means for European Privacy
The European Parliament, in a surprising turn, revived a controversial bill on July 9, 2026, that would allow tech companies to scan digital communications for child sexual abuse material (CSAM). This legislation, previously rejected in March, has been sent to EU member states for approval. The renewed push includes a key exemption for end-to-end encrypted services, a compromise that has left both privacy advocates and child protection groups with lingering concerns.
Outlook
Background
The 'zombie' bill refers to a proposal that was effectively dead just a few months ago. On March 25, 2026, the European Parliament decisively rejected a proposal to extend a temporary regime that permitted online platforms to voluntarily scan private messages for CSAM under an exception to EU privacy rules. The vote saw 311 lawmakers against, 228 in favor, and 92 abstentions, signaling strong opposition to what critics have dubbed 'chat control' due to its significant privacy implications.
Yesterday, July 9, 2026, a 'chaotic Strasbourg vote' and the use of a 'rarely used procedure' allowed the center-right European People’s Party (EPP) to push the bill back onto the agenda. This maneuver bypassed the standard legislative process, sending the proposal directly to EU capitals for reconsideration. The revived bill still aims to grant tech companies the legal right to scan for CSAM, but crucially, it now explicitly exempts end-to-end encrypted communications from mandatory scanning. This exemption is a direct response to widespread concerns that mandatory scanning of encrypted services would fundamentally undermine digital privacy and security, effectively creating backdoors into private conversations. However, this compromise has not fully satisfied either side; privacy advocates argue it still opens the door to intrusive surveillance, while some child protection advocates worry it might limit the effectiveness of detection efforts.
Precedents
The tension between digital privacy and law enforcement's access to data is not new within the European Union, or globally. For years, EU institutions have grappled with how to combat serious crimes like child sexual abuse while upholding fundamental rights, particularly the right to privacy and the security of communications. Previous legislative attempts, such as the Data Retention Directive, have faced legal challenges and been struck down by the European Court of Justice on privacy grounds. This history of judicial pushback has shaped subsequent proposals, leading to the complex compromises seen in the current bill, such as the encryption carve-out.
The debate around 'chat control' mirrors earlier clashes over surveillance powers, notably post-9/11, where governments sought broader access to digital communications in the name of national security. Each iteration of such legislation has sparked intense public and expert debate, with a consistent divide between those prioritizing security and those defending privacy and the integrity of encrypted communications. The current situation, with a previously rejected bill being revived through procedural means, reflects the persistent political pressure to find a legislative solution to CSAM, even as the technical and ethical challenges remain deeply contentious.
This revived bill carries significant implications for millions of European citizens and the global technology industry. For individuals, it raises fundamental questions about the limits of their digital privacy. While the encryption carve-out offers some protection for services like WhatsApp or Signal, it leaves open the possibility of scanning on other platforms. This could lead to a two-tiered system of digital communication, where users might feel compelled to use encrypted services to avoid potential surveillance, even for non-sensitive communications.
For tech companies, the bill presents a complex operational and legal challenge. Implementing scanning technologies, even on non-encrypted platforms, requires significant investment and carries the risk of false positives, which could lead to wrongful accusations or the flagging of innocent content. Furthermore, the ongoing debate creates regulatory uncertainty, complicating product development and service offerings within the EU. The political maneuvering to revive this bill also highlights the deep ideological divisions within the EU on digital rights, a division that will likely influence the broader, permanent legislation currently under negotiation. The outcome of this process will set a precedent for how the EU balances security imperatives with core digital freedoms in an increasingly connected world.
Scenarios
AnalysisThe path forward for this revived child-abuse scanning bill is uncertain, with several potential outcomes:
1. Approval with Limited Scope: EU member states could approve the bill, allowing it to become law. In this scenario, tech companies would be legally empowered to scan for CSAM on non-encrypted services, while encrypted platforms would remain exempt. This outcome would likely be seen as a partial victory for child protection advocates, offering some new tools, but would still face criticism from privacy groups who argue that any form of general scanning sets a dangerous precedent. The practical impact on child abuse detection would then depend on the prevalence of CSAM on non-encrypted platforms and the effectiveness of the scanning technologies.
2. Rejection or Significant Amendments by Member States: Despite the Parliament's procedural push, member states could still reject the bill or demand substantial amendments. National governments often have varying stances on privacy and surveillance, and a strong coalition of states could block the proposal. This would send the EU back to the drawing board, increasing pressure on the ongoing negotiations for a more comprehensive and permanent regulation. Such a rejection would reinforce the EU's commitment to digital rights, but would also intensify the search for alternative, privacy-preserving methods to combat CSAM.
3. Further Legal Challenges: Even if the bill is approved, it could face legal challenges in the European Court of Justice. Privacy organizations and civil liberties groups have a history of scrutinizing EU legislation that touches on fundamental rights. Arguments could center on whether the scanning provisions, even with the encryption carve-out, are proportionate and necessary, or if they constitute a general and indiscriminate surveillance measure. A successful challenge could invalidate parts or all of the law, creating further legal uncertainty and requiring the EU to revise its approach once again.
Timeline
Frequently Asked Questions
Discussion
Be the first to share your thoughts.