Breyer, a former MEP who has fought this file for four years, calls the extension a loss with his line 'Our children lose out.' He argues voluntary scanning floods law enforcement with false positives while doing little to protect actual victims, and warns the extension keeps the compliance machinery running so the Commission can keep pushing the mandatory Chat Control 2.0 with client-side scanning.
By submitting Breyer's post to HN where it drew 1,354 points and 637 comments, rapnie amplifies the argument that the Parliament's vote is a serious setback for digital rights in the EU. The strong upvote signal indicates the developer community broadly shares the concern that voluntary scanning is a stepping stone toward mandatory surveillance.
The editorial cites Swiss federal police data showing roughly 80% of machine-generated CSAM referrals were not criminally relevant — a mix of legal images, consensual teen sexting, and perceptual-hashing false positives — with German police reporting similar ratios. The argument is that even if you accept the goal, the tool as deployed generates so much noise that it wastes investigative capacity that could go to real cases.
The editorial frames the vote as procedurally boring but politically consequential: it preserves the legal carve-out under ePrivacy/GDPR, keeps compliance infrastructure running at Meta, Google, and Microsoft, and buys the Commission more time to push the mandatory version that would require client-side scanning on every EU messaging app regardless of encryption. In other words, killing 1.0 was the leverage point to kill 2.0, and that leverage is now gone.
The European Parliament voted to extend Chat Control 1.0 — formally the ePrivacy derogation that lets communication providers voluntarily scan private messages, emails, and chats for child sexual abuse material (CSAM) without falling foul of EU confidentiality-of-communications rules. Without the extension, the legal carve-out would have expired and any provider still scanning would have been operating in a grey zone under GDPR and the ePrivacy Directive.
Former MEP Patrick Breyer, one of the loudest voices against the regime, called the vote a defeat: *"Our children lose out."* His argument, refined over four years of fighting this file, is that the current voluntary scanning is both ineffective and harmful — it floods law enforcement with false positives while normalising the surveillance architecture that Chat Control 2.0 wants to make mandatory.
The extension itself is procedurally boring; the significance is political. It keeps the file open, keeps the compliance machinery running at Meta, Google and Microsoft, and buys the Commission more time to keep pushing the mandatory version — the one that would require client-side scanning on every messaging app operating in the EU, encryption be damned.
If you've only half-followed this saga, here's the honest version of the disagreement. Everyone agrees CSAM is a problem worth solving. The disagreement is whether scanning private messages by default is a solution or a new class of problem.
The pro-scanning case rests on volume: platforms report tens of millions of hashes per year to NCMEC, and some fraction of those become real investigations. The anti-scanning case rests on the base-rate problem. Swiss federal police reported that around 80% of the machine-generated CSAM referrals they received were not criminally relevant — legal images, consensual teen sexting, false positives from perceptual hashing. German police have reported similar ratios. When you're scanning billions of messages to catch a rare signal, even a 99.9%-accurate classifier produces mostly noise, and that noise lands in the inbox of investigators who are already understaffed.
The technical objection is sharper still. Client-side scanning — the mechanism Chat Control 2.0 relies on — breaks the security model of end-to-end encryption not by attacking the cryptography but by moving the adversary inside the endpoint. Once the client is contractually required to inspect plaintext before encryption and phone home on matches, "end-to-end encrypted" becomes a marketing claim. Apple learned this the expensive way in 2021, shipped a CSAM-scanning design for iCloud Photos, took a beating from Matthew Green, the EFF, and its own security researchers, and quietly killed the feature. The EU proposal wants to mandate a version of that design across every messenger — Signal, WhatsApp, Matrix, Threema, Session, and anything you might be building on top of libsignal.
The community reaction has been consistent for years and has not moved the political needle much. Signal's Meredith Whittaker has said publicly that Signal will leave the EU market rather than implement client-side scanning. The Chaos Computer Club, GFF, and every credible academic cryptography group in Europe has published against it. The Council's own legal service concluded a previous draft was likely incompatible with the Charter of Fundamental Rights. And yet: the file lives, the derogation is extended, and the mandatory version keeps getting reintroduced with cosmetic edits.
If you build or operate anything that touches private messages in the EU, the extension is not a nothing-burger. A few concrete things to internalise:
Your threat model just quietly got another actor. If you ship a messaging feature — even a support chat, even an internal comms tool — a client-side scanning mandate would apply to "number-independent interpersonal communications services," which the EU defines broadly enough to catch a lot of B2B SaaS. The 2.0 draft has repeatedly been drafted with WhatsApp in mind and drafted broadly enough to hit Slack-shaped things. Read the scope every time a new version drops; it moves.
Voluntary scanning is not a neutral baseline. If you're using a hyperscaler's messaging or email API — Gmail, Microsoft Graph, Meta's Messenger platform — your users' messages are already being fingerprinted against known-CSAM hash databases and, increasingly, against ML classifiers that flag "unknown" material and grooming patterns. That's fine for the intended purpose; it is not fine as an assumption in your privacy policy or your DPIA. Say it out loud in your docs.
E2EE is a design choice with a political tail. If you're picking between a self-hosted Matrix deployment, a Signal-protocol integration via libsignal, or building on a mainstream cloud messaging API, the political trajectory is now part of the tradeoff and not just the crypto. Signal's public stance means a mandatory-scanning regime probably ends its EU availability; Matrix homeservers under your own control give you more room but also more compliance surface if the regulation reaches you. Neither is a comfortable answer.
The compliance work is not hypothetical. Providers currently running voluntary scanning under the 1.0 derogation have to keep DPIAs, transparency reports, and human-review pipelines in place. If you're one of them, the extension means another cycle of reporting obligations, not a break. Budget the ops time.
The interesting question is not whether Chat Control 2.0 passes in its current form — it probably won't — but how many more iterations the Commission gets before the file either dies or mutates into something that survives court challenge. Every extension of 1.0 is another year on the runway. The pattern across the last three Council presidencies has been the same: propose mandatory scanning, get shouted down by member states with strong civil-liberties lobbies (Germany, Netherlands, Austria, Poland at various points), quietly reintroduce with softened language, repeat. Practitioners should stop treating this as a story that might go away. It won't. Design as if client-side scanning is a regulatory possibility for the EU market by 2028, and price the migration or exit into your roadmap now rather than in the panic-week after the trilogue.
FTA:What changes with the return of Chat Control 1.0—and what stays the same:*What is coming back:* US tech companies are once again allowed to scan private messages without a warrant or prior suspicion. This affects direct messages on platforms like Instagram, Discord, Snapchat, Skype, and Xbox, as
Stupid parliamentary trick: Hold the vote on the day before the summer break - ensuring that many people have already returned to their home countries. Then use a sort of "reverse" parliamentary trick: the default is that this legislation is accepted. They needed an absolute majority - not
This is a nice piece of democracy right here:"a measure it had rejected twice in March. Although a majority of voting Members of the European Parliament (MEPs) actually opposed the regulation (314 against, 276 in favor, 17 abstentions), the motion to reject it failed to secure the required abso
Roberta Metsola's actions this week jeopardise the legitimacy of the EU project as a whole.It's clear that member countries use the EU as a blame-laundering mechanism to pass domestically unpopular laws, but the forcing of this vote under the urgency procedure that requires absolute majori
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
The EU is a farce, an undemocratic virtue signaling organization, and this is why:- The Parliament voted against the first reading of this proposal twice in 2026, the first time they only supported limited cases for it, while the second time they actually defeated it fully.- The Commission didn'