by Michael Hollister
German version published at GlobalBridge on July 12, 2026

4.165 words * 22 minutes readingtime

Independent geopolitical analysis – delivered to your inbox every week.

Rejected, Overruled, Enacted

On July 9, 2026, a majority of the European Parliament voted against so-called Chat Control – an exemption that allows providers like Google, Meta, and Microsoft to automatically scan private messages for depictions of child sexual abuse without specific suspicion. 314 members voted to reject the Council position, 276 voted in favor, 30 abstained. In democratic terms, the matter was clear-cut: a definitive majority of votes cast was against it.

Chat Control went into effect anyway. Until April 2028 – two full years.

This is not an error or an oversight. It is the result of a procedure designed to produce exactly this outcome. A procedure that inverted the burden of proof, scheduled the vote for the last sitting day before the summer recess, and turned a proposal already rejected twice into law through the mechanics of an absolute majority requirement – even though the majority of members present voted against it.

It was not the first time. On March 26, 2026, Parliament had rejected an extension of the interim regulation by 311 to 228 votes. As early as November 2023, in the context of the permanent CSA Regulation, it had passed a cross-party rejection of the indiscriminate scanning of private communications – a different procedure, but the same fundamental question. Three times No to indiscriminate scanning – and law nonetheless. A sequence of events that raises questions reaching far beyond Chat Control.

Anyone who wants to understand how laws come into existence in the European Union that Parliament expressly did not want will find a precedent here. And anyone who wants to understand who these laws serve has to ask a question that comes up strangely rarely in public debate: Why are the world’s largest data corporations lobbying to be allowed to search private messages at their own expense – if doing so supposedly brings them no benefit?

In concrete terms, Chat Control 1.0 permits operators of messengers, email services, and cloud storage to automatically scan their users’ messages, images, and videos – without a court order, without specific suspicion, without the affected user ever learning about it. The digital correspondence secrecy of 450 million Europeans is on the table – and the official justification is: child protection.

This article traces how this result came about. And it asks the questions it raises.

Three Times No, Still Yes

The chronology speaks for itself. It begins not on July 9, but months earlier – and reading it reveals a strategy.

Since 2021, Regulation (EU) 2021/1232 had permitted operators of messengers, email services, and cloud storage to voluntarily and automatically scan private messages for depictions of child sexual abuse. The regulation was explicitly designed as a temporary interim measure – a bridge until a permanent solution could be negotiated. It expired on April 3, 2026.

On March 26, 2026, the European Parliament rejected an extension of this interim regulation by 311 to 228 votes, with 92 abstentions. This was not a close result. The responsible Justice Committee had previously voted against a compromise proposal. Rapporteur Birgit Sippel had publicly spoken against it. Civil society welcomed the outcome. A key factor in the rejection was an EU Commission evaluation of the existing practice, which failed to demonstrate the proportionality of indiscriminate mass surveillance. Democratically, the matter was settled – as clearly as parliamentary decisions get.

Then something happened that diplomats described to netzpolitik.org as “unprecedented.”

On July 2, 2026, the Council of the EU adopted the original Commission position as its own Council position. This triggered the so-called second reading procedure – a mechanism whose significance most citizens are unlikely to be aware of, but which in this case proved decisive.

On July 6, independent MEP Martin Sonneborn attempted during the opening session in Strasbourg to draw Parliament President Roberta Metsola’s attention to a procedural violation. Sonneborn and the writer and MEP Sibylle Berg had previously written to Metsola demanding that the planned emergency motion not be put to a vote. Their arguments: the legislative procedure was already in its second reading – Parliament’s Rules of Procedure do not provide for an emergency procedure at this stage. Instead, the responsible committee would need to deliberate first. Moreover, the motion was formally flawed: it was submitted on July 1, 2026, even though the Council position was not officially transmitted to Parliament until July 2, 2026. The fast-track procedure denied members the time that the EU treaties expressly grant them to organize the required absolute majority. Metsola had told the press that everything was in order. No response to the written objection was forthcoming. When Sonneborn raised the issue again in plenary – waving the printed Rules of Procedure – the Parliament President cut his microphone after exactly 60 seconds. Formally permissible, but in parliamentary practice virtually never applied. RT DE covered the 60-second microphone incident. The Pirate Party Germany called it a “democratic disgrace.”

On July 7, Parliament voted 331 to 304, with 11 abstentions, to initiate the fast-track procedure. A margin of 27 votes. The substantive vote was scheduled for July 9 – the last plenary day before the summer recess.

Here is where the decisive mechanism comes in. In the second reading procedure, different rules apply than in the first reading. The logic is inverted. It is not the proponents of a measure who must assemble a majority – the opponents must. Rejecting or amending the Council position requires the absolute majority of all members of Parliament: with 720 seats, that means 360 or 361 votes. Not the majority of those present – the majority of all members, whether present or not. Anyone absent does not count as a vote against, but the threshold remains just as high. If it is not reached, the Council position is automatically deemed adopted – even if the majority of votes actually cast were against it.

In plain terms: ten people are supposed to decide whether a proposal goes through. Normally, you need six Yes votes to pass it. In the second reading, you need six No votes to stop it. If only eight people show up and five vote against, the proposal goes through anyway – even though the majority of those present rejected it. Every empty seat helps the Council position. On the last working day before the summer recess, the seats do not get fuller.

On July 9, 314 members voted to reject the Council position, 276 voted against rejection, 30 abstained. The required 361 votes were missed by 47. Chat Control now applies until April 2028.

Rapporteur Sippel called the procedure an “unfair maneuver.” Independent MEP Friedrich Pürner commented: “Right before the summer recess – while everyone is packing their beach bags and eyeing the World Cup – the Parliament President quietly slips the issue back onto the agenda.” The Digitale Gesellschaft called it a “devastating signal for European democracy.” Konstantin Macher of the Digitale Gesellschaft made the point that captures the entire absurdity: “Even if the legislative text was adopted today, the voting results underscore that a majority of Parliament continues to reject mass surveillance.”

A majority rejects. The law takes effect. Both at the same time. In no national parliament across the EU would such an outcome be conceivable – no Bundestag, no Assemblée nationale, no Folketinget would treat a law as adopted when the majority of members present voted against it. In the European Parliament, that is exactly what happened. Not through a glitch in the system, but through a system that functions exactly as designed – provided you use it at the right moment.

The Pretext and the Numbers

The official justification for the fast-track procedure was: child protection. After the interim regulation expired in April, a regulatory gap needed to be closed as quickly as possible. The tone from the EPP group was urgent: one could not go into the summer recess while children were unprotected. No protection vacuum – that was the line. Child protection is an argument that no one can openly oppose. Anyone who argues against Chat Control appears to argue against the protection of children. This dynamic is no accident – it is by design. It immunizes the project against criticism before the debate even begins.

The available data tells a different story.

The Federal Criminal Police Office (BKA) stated to netzpolitik.org: a concrete connection between the expiration of the interim regulation and a decline in reports “cannot be established at this time.” Reports to the BKA had not collapsed after the regulation expired in April. The U.S. platforms – led by Google and Meta – continue scanning by their own account regardless of whether the EU provides them with a legal basis. Patrick Breyer, former MEP and one of the most knowledgeable critics of the project, documents precisely this. An urgent need simply cannot be derived from the BKA’s numbers.

On top of this, there is the EU Commission’s own evaluation. At the end of 2025, the Commission presented an assessment of the existing Chat Control practice, and this assessment was the reason Parliament rejected the extension in March. The results were devastating for proponents: the proportionality of indiscriminate mass surveillance could not be demonstrated. Error rates of the deployed scanning technologies run as high as 20 percent according to the Commission’s evaluation – meaning that with millions of messages scanned, hundreds of thousands of false reports are generated, placing real people under suspicion of sexual offenses. A clear connection between suspicious-activity reports and actual convictions could not be established. And when EU Commissioner Magnus Brunner was asked directly in the LIBE Committee how many children had been rescued through Chat Control, he could not name a single number.

Over 60 percent of suspicious-activity reports, according to official EU figures, do not even originate from private chats but from the scanning of public posts and cloud storage – areas not covered by the ePrivacy exemption at all. Chat Control regulates the scanning of private communications. The bulk of the results comes from an area it does not even touch. This raises a question that is astonishingly rarely asked in the debate: if the overwhelming majority of reports comes from publicly accessible sources that require no ePrivacy exemption – what is the exemption that permits the scanning of private messages actually for?

The consequences of the error rate affect not abstract datasets but real people. A false report means: a citizen falls under suspicion of a serious sexual offense. In Germany, such a report is sufficient for a house search under Section 184b of the Criminal Code – anyone falsely flagged can find the police at their door one morning, regardless of whether the suspicion is ever confirmed. At a 20 percent error rate across millions of scanned messages, these are not isolated cases.

The German Child Protection Association – the people whose professional mission is the protection of children – had already spoken out against Chat Control in October 2025, demanding “targeted measures instead of indiscriminate mass surveillance” from the German government. The European Data Protection Supervisor warned in three consecutive opinions that the regulation constitutes a disproportionate interference with fundamental rights. The Council’s own Legal Service – the legal department of the very institution that adopted the Council position – raised concerns that the voluntary scanning measures could conflict with the EU Charter of Fundamental Rights.

No collapse in reporting numbers. No demonstrated effectiveness. No verifiable urgency. A 20 percent error rate. No number of children rescued. The Child Protection Association against it, the Data Protection Supervisor against it, the Council’s own Legal Service raising concerns. That is the evidence base on which a fast-track procedure was launched and an already-rejected law was pushed through.

The Question Nobody Asks

What Chat Control 1.0 concretely permits providers to do is quickly summarized: Google, Meta, Microsoft, and other platforms may automatically scan private messages, images, and videos – voluntarily, without a court order, without specific suspicion against the user. The regulation states: data may only be processed for the purpose of detecting abuse material. The scanning is voluntary. No one forces the companies to do it. It is a right, not an obligation.

And scanning costs money. Servers must be operated, scanning software licensed, storage capacity maintained for processing, reporting chains built, and personnel provided to handle suspicious-activity reports. With billions of messages daily, these are not trivial amounts – they run into the millions annually, paid out of the providers’ own pockets.

This is where it gets interesting. Because the loudest proponents of the extension do not sit in Parliament and not in the Council. They sit in California.

DOT Europe, the European lobby association whose members include Google, Meta, and TikTok, actively pushed for the extension of Chat Control. The association intervened with the EU institutions when the regulation was about to expire. Some member companies, according to internal documents published by netzpolitik.org, threatened to “discontinue voluntary detection after the summer recess” if no new legal basis were created – a threat that increased the political pressure on Parliament. The companies demanded the legal basis that permits them to scan. They are thus demanding a right that costs them money – server capacity, computing time, data storage, personnel expenses. A right they exercise voluntarily, that costs them money, and that – under strict compliance with purpose limitation – brings them no economic benefit. No advertising revenue, no user data, no product improvement. Only costs.

The business logic of this demand only makes sense under one condition: if the infrastructure built for scanning is also usable for other purposes. Or, put more sharply: if the data generated through scanning is not used exclusively for the stated purpose.

The regulation says: data may only be processed for the stated purpose. That is the assurance. But EU assurances have recently developed a striking pattern of tension with actual practice.

The EU Vehicle Safety Regulation mandates that camera data from vehicle interiors must remain locally in the vehicle and that no biometric identification may take place. Volvo told the Belgian broadcaster VRT, when asked directly, that it processes the data on external servers. Mercedes confirmed using image and sensor data from customer vehicles for training purposes. Renault stated that it shares personal data with partners. Three manufacturers, three documented contradictions of the regulation – confirmed on direct inquiry by a public broadcaster.

The EU age verification app was supposed to operate on a “zero-knowledge” principle: only age is verified, no personal data leaves the device. IT security consultant Paul Moore publicly demonstrated that the system fails at both of its stated objectives – circumventable as an age filter, structurally compromised as a data-protection system. Moore called the subsequent patches “security theater” and concluded that the problem was not a bug but a design flaw. The EU Commission was informed. The rollout to 27 member states continued.

A pattern: assurance here, practice there. The regulation says “may not,” but it does not say “cannot.” And the companies that demonstrably violated the assurance on interior vehicle cameras are in some cases the same ones receiving the same assurances on Chat Control – while simultaneously lobbying with vigor to keep this authority.

A footnote that proves nothing but fits the picture: Martin Sonneborn pointed out that Parliament President Metsola visited California in late May 2026 – meeting the heads of Google, Meta, and Apple. A few weeks later, she put Chat Control back on the agenda. The sequence proves nothing. But it stands out.

Anyone who, against this backdrop, trusts that Google, Meta, and TikTok will use the infrastructure built for scanning private messages exclusively for the stated purpose must answer a simple question: Why do these companies spend millions to be allowed to do something that – if the rules are followed – brings them only costs and no benefit? The question is legitimate. The reader draws their own conclusion.

The Promise from Berlin

The German government under Friedrich Merz had promised the German public that indiscriminate chat controls were “taboo.” The word “taboo” was deliberately chosen – it sounds like a red line, like non-negotiability.

What the German government actually did in Brussels was documented by the Digitale Gesellschaft. Internal negotiation documents published by netzpolitik.org reveal Germany’s position in the trilogue negotiations on the permanent CSA Regulation: Germany was not opposed to mandatory Chat Control “as long as it constitutes a supplementary measure to voluntary scanning.” The scope of voluntary Chat Control should “not be restricted and should cover both known and unknown CSAM content as well as grooming.” The Digitale Gesellschaft called this a “flagrant foul” against the public.

Publicly against, internally for. Defending fundamental rights before the electorate while backing mass surveillance behind closed doors in Brussels. The method is not new: delegate uncomfortable decisions to Brussels, wash your hands at home, and point to “the EU.” What is new about Chat Control is the brazenness of the contradiction: saying “taboo” while simultaneously carrying the procedural trick that turns the taboo into law. CDU and CSU voted nearly unanimously in the European Parliament for the fast-track procedure that pushed Chat Control through on July 9. The same party whose government says “taboo” in Berlin carries the procedural trick in Strasbourg that turns the taboo into law.

The promise of end-to-end encryption as a protective barrier stands on similarly shaky ground. An amendment by the liberal Renew Europe group, intended to exempt encrypted communications from Chat Control’s scope, was adopted. That sounds reassuring. In practice, the question is: How do you implement it? According to numerous IT security experts, a clean separation between encrypted and unencrypted content is technically unworkable without undermining the encryption itself. Checking whether a message is encrypted requires access to the device – and that access is precisely the gateway for so-called client-side scanning, which circumvents encryption by scanning the message on the user’s device before it is encrypted. The amendment exists on paper. Its technical implementation is an open question whose answer the experts already know. And even if the exemption for encrypted communications were technically implemented: the legislative text now goes back to the Council, which must adopt it unchanged within three months. Should the Council not accept the amendment, the Conciliation Committee is convened – and the bargaining starts over. The encryption exemption that Parliament voted on July 9 thus has no legally binding status yet. It is a parliamentary signal, not a shield.

What Comes Next

Chat Control 1.0 is the interim regulation – the provisional arrangement that becomes permanent. The permanent regulation – officially the CSA Regulation on the prevention and combating of child sexual abuse, known in public debate as Chat Control 2.0 – has been negotiated in parallel for four years. In the fifth trilogue on June 29, mandatory client-side scanning was removed from the current draft, but negotiations continue. The next trilogue is scheduled for September 29. The permanent regulation could compel providers to scan against their will – turning the voluntary authority into an obligation. Including encrypted communications.

The negotiations have been running for four years. The time pressure is growing, the positions are far apart: the Commission wants to compel all providers to scan. Parliament wants to scan only suspicious users, in a targeted manner. The Council wants no obligation but the right to voluntary scanning as broadly defined as possible. What emerges in the end is open – but the direction is clear: more access to private communications, not less.

Even within the Council, unity is fragile. Italy voted for the current text but simultaneously filed a formal warning about the risks of mass surveillance – an unusual step that documents the reservations even among proponents. The Council’s Legal Service raised concerns. And the Commission – which initiated the entire process – was unable to demonstrate either the effectiveness or the proportionality of the existing practice.

Running in parallel are age verification and the EUDI Wallet – the European digital identity wallet designed to bundle ID, driver’s license, health data, banking details, and government communications into a single system, with full deployment planned by the end of 2026. Three projects, one timeline, one direction: anyone who communicates gets scanned; anyone who moves online gets identified; anyone who uses government services gets logged. What was decided on July 9 is the provisional measure – the permission for voluntary scanning. What will be negotiated in September is the obligation. And the difference between “may” and “must” is the difference between a bouncer who can look inside and a bouncer who has to look inside. At everyone. At every message. At every image. Without exception.

The broader context – how interior vehicle surveillance, data retention, Chat Control, age verification, and digital identity converge into a comprehensive profile – is examined by the author in the article “Five Layers, One Profile” at www.michael-hollister.com.

What Remains

The findings are on the table, and they are not in dispute.

The European Parliament rejected Chat Control three times – in November 2023 in the context of the permanent regulation, in March 2026 as an extension of the interim regulation, and on July 9, 2026, when 314 members voted against 276. Three times, a majority opposed the indiscriminate surveillance of private communications. Yet since July 9, 2026, it is once again the law – pushed through via a fast-track procedure that according to two MEPs violates the Rules of Procedure, scheduled for the last sitting day before the summer recess, adopted through a voting mechanism in which not the proponents but the opponents had to clear the bar. And the member who raised the procedural violation had his microphone cut after 60 seconds.

The urgency used to justify the procedure finds no support in the data. The BKA reports no collapse in reporting numbers. The Commission could not demonstrate proportionality and could not produce a single number of children rescued. The Child Protection Association opposes the measure. The platforms continue scanning regardless, with or without an EU legal basis. And the 20 percent error rate means that hundreds of thousands of law-abiding citizens are caught in the automated dragnet of suspicion for sexual offenses.

The companies that stand to gain the most from this authority are lobbying hardest for it – even though the authority, if purpose limitation is honored, brings them only costs and no benefit. The government that publicly opposes it works internally in its favor. And the assurances the EU has given for comparable projects – data stays local, no biometric capture, privacy preserved – have been contradicted by the companies themselves in at least three documented cases.

There are always two reasons, my grandmother used to say: the one they give you, and the real one. Chat Control is justified by child protection. The data shows that as a child-protection measure, it is neither effective nor proportionate. The companies that make billions from data are fighting to keep looking into data. And the procedures used to push the law through systematically circumvent the democratic will of Parliament.

That is the finding. The reader draws their own conclusion.

German version published at GlobalBridge on July 12, 2026

The week’s most important geopolitical developments – independently assessed.

About the Author

Michael Hollister
is a geopolitical analyst and investigative journalist. He served six years in the German military, including peacekeeping deployments in the Balkans (SFOR, KFOR), followed by 14 years in IT security management. His analysis draws on primary sources to examine European militarization, Western intervention policy, and shifting power dynamics across Asia. A particular focus of his work lies in Southeast Asia, where he investigates strategic dependencies, spheres of influence, and security architectures. Hollister combines operational insider perspective with uncompromising systemic critique – beyond opinion journalism. His work appears on his bilingual website (German/English) www.michael-hollister.com and in investigative outlets across the German-speaking world and the Anglosphere.

If you regularly read my updates and analyses, I would be grateful for your ongoing support.
5 USD per month – 1 coffee !!!

Sources

1. Netzpolitik.org, 09 July 2026 – EU-Parlament: Freiwillige Chatkontrolle geht mit Verfahrenstrick durch: https://netzpolitik.org/2026/eu-parlament-freiwillige-chatkontrolle-geht-mit-verfahrenstrick-durch/
2. Netzpolitik.org, 03 July 2026 – Interne Dokumente: EU-Staaten wollen Chatkontrolle-Zombie zurückbringen: https://netzpolitik.org/2026/interne-dokumente-eu-staaten-wollen-chatkontrolle-zombie-zurueckbringen/
3. Netzpolitik.org, 17 June 2026 – Interne Dokumente: Trilog zur Chatkontrolle geht in entscheidende Phase: https://netzpolitik.org/2026/interne-dokumente-trilog-zur-chatkontrolle-geht-in-entscheidende-phase/
4. Digitale Gesellschaft, 09 July 2026 – Chatkontrolle: Zur heutigen Neuabstimmung im Europäischen Parlament: https://digitalegesellschaft.de/2026/07/chatkontrolle-zur-heutigen-neuabstimmung-im-europaeischen-parlament/
5. Piratenpartei Deutschland, 08 July 2026 – Eilverfahren zur Chatkontrolle bricht Parlamentsregeln: https://piratenpartei.de/2026/07/09/eilverfahren-zur-chatkontrolle-bricht-parlamentsregeln-satiriker-sonneborn-wird-bei-protest-das-mikrofon-abgestellt/
6. Martin Sonneborn, 06 July 2026 – X-Post zum Mikrofon-Vorfall und Geschäftsordnungsverstoß: https://x.com/MartinSonneborn/status/2074201042703778256
7. RT DE, 07 July 2026 – Mikro abgestellt: Sonneborns 60-Sekunden-Protest gegen Chatkontrolle: https://de.rt.com/kurzclips/video/285256-mikro-abgestellt-sonneborns-60-sekunden-protest-gegen-chatkontrolle/ (cited, not linked per editorial policy)
8. TKP.at, 07 July 2026 – Chatkontrolle und das Ende des Briefgeheimnisses: https://tkp.at/2026/07/07/chatkontrolle-und-das-ende-des-briefgeheimnisses-eu-killt-grundrecht-der-aufklaerung-im-eilverfahren/
9. Junge Freiheit, 09 July 2026 – EU-Parlament winkt Chatkontrolle im Eilverfahren durch: https://jungefreiheit.de/politik/ausland/2026/eu-parlament-winkt-chatkontrolle-im-eilverfahren-durch-nachdem-sie-zweimal-abgelehnt-wurde/
10. Schwulissimo, 09 July 2026 – Chatkontrolle beschlossen – viel Kritik am Eilverfahren: https://schwulissimo.de/neuigkeiten/chatkontrolle-beschlossen-viel-kritik-am-eilverfahren
11. Dr. Web, 08 July 2026 – Chatkontrolle 2026: Was plant das EU-Parlament jetzt?: https://www.drweb.de/chatkontrolle-das-eu-parlament-ebnet-per-eilverfahren-den-weg-zur-neuabstimmung/
12. Tarnkappe.info, 07 July 2026 – Bisherige Chatkontrolle soll erstmal verlängert werden: https://tarnkappe.info/artikel/netzpolitik/bisherige-chatkontrolle-soll-erstmal-verlaengert-werden-331170.html
13. Patrick Breyer – Chatkontrolle: Verhandlungsstand und Zeitplan: https://www.patrick-breyer.de/beitraege/chatkontrolle/
14. Journalistenwatch, 07 July 2026 – EU-Chatkontrolle: Der Alptraum wird real: https://journalistenwatch.com/2026/07/07/eu-chatkontrolle-der-alptraum-wird-real/
15. Michael Hollister, May 2026 – Die Schutz-App, die nichts schützt: https://www.michael-hollister.com
16. Michael Hollister, July 2026 – Fünf Schichten, ein Profil: https://www.michael-hollister.com

© Michael Hollister – All rights reserved. Redistribution, publication or reuse of this text requires express written permission from the author. For licensing inquiries, please contact the author via www.michael-hollister.com.