EU temporarily extends controversial chat-scanning regime until 2028

European governments have confirmed a temporary regime allowing messaging services to voluntarily deploy measures to detect suspected child sexual abuse material until 2028, preserving a carve-out for end-to-end encrypted messages previously introduced by MEPs. The European Parliament adopted amendments on July 9, 2026, excluding communications to which end-to-end encryption applies from the scope of the derogation, meaning platforms such as WhatsApp and Signal remain exempt. The Council approved Parliament's amendments on July 23, 2026, and the temporary regime was formally reinstated until April 3, 2028, by Regulation (EU) 2026/1881.

The EU's exclusion of end-to-end encrypted services from mandatory scanning reflects the difficulty of legislating technical access without breaking encryption, but it also highlights the structural limits of content-scanning as a primary safeguard. Detection that assesses patterns of sustained targeting, escalation and coercion in direct-message conversations addresses the underlying harm without requiring plaintext access to every message. This approach does not scan content or break encryption; instead, it surfaces behavioral signals that indicate grooming, sextortion or abuse in progress, reporting the shape and seriousness of a conversation to the stakeholder who can act, whether that is a parent, a school, a platform moderator or law enforcement. Where the regulation attempts to balance child protection and encryption, targeted behavioral detection provides a mechanism that does not require the trade-off.