The European Parliament's Renew Europe group voted against extending a temporary exemption from EU privacy rules that allowed online platforms to voluntarily scan for and report child sexual abuse material, arguing the extension would further delay - and potentially replace - the permanent legislative framework that child protection requires. The vote, pushed to the final day of July, passed despite Renew's opposition, in part because securing an absolute majority under those scheduling conditions proved exceptionally difficult. The group secured two amendments explicitly protecting end-to-end encrypted communications from any scanning obligation, but condemned the final text as inadequate.
A Temporary Fix That May Become Permanent by Default
The derogation in question suspends, on a provisional basis, certain provisions of the ePrivacy Directive to permit platforms to detect and report CSAM voluntarily. It was always conceived as a bridge measure - a stopgap while EU institutions negotiated a formal, binding regulation. That permanent CSAM Regulation has stalled. And each successive extension of the temporary derogation reduces the urgency of reaching it.
Renew Europe's central argument is structural: without a permanent framework, Europe loses a dedicated EU Centre for child protection, loses harmonised rules across all member states, loses binding obligations on platforms, and loses mandatory prevention measures that voluntary compliance cannot replicate. What remains is a patchwork in which private companies - the largest of them wielding enormous infrastructure - decide, largely on their own terms, when and how to scan private communications. That is not a child protection regime. It is an arrangement that concentrates sensitive decisions about millions of people's personal messages in corporate hands, without clear democratic guardrails.
Encryption Carve-Out: A Real But Partial Win
Renew's two adopted amendments introduced explicit language excluding end-to-end encrypted communications from any scanning obligation in the extended derogation. This matters technically and politically. End-to-end encryption ensures that only the sender and intended recipient can read a message; the platform itself holds no decryption key. Any scanning at the content level would either require breaking that encryption or installing client-side scanning - mechanisms that security researchers and digital rights advocates have long warned would fundamentally undermine the security architecture that protects not just private citizens but journalists, lawyers, activists, and public officials.
The encryption carve-out is therefore meaningful. But as both Renew shadow rapporteurs stressed, it addresses one vector of harm without resolving the underlying legislative vacuum. The final text still contains gaps on grooming detection and newly produced material, and it relies on voluntary action rather than enforceable obligation. Voluntary frameworks, by definition, apply unevenly - larger platforms may comply, smaller ones may not, and the standard of what constitutes adequate detection remains undefined.
The Procedural Concern Behind the Policy Dispute
Shadow rapporteur Irena Joveva raised an issue that goes beyond the substance of child protection law. The Council, backed by one political group in Parliament, forced the vote on the final day of July - a scheduling choice that made reaching the absolute majority required for the measure significantly harder. Joveva noted that previous votes had demonstrated Renew had the numbers. The July timing appears to have been a deliberate tactic.
If that reading is accurate, it sets a worrying precedent. Parliamentary votes on sensitive rights questions should not be decided by calendar management. The legitimacy of EU legislative outcomes depends on members being present and able to vote, and on the timing of votes not being weaponised to suppress majorities. Renew's call here is not simply about CSAM policy - it is about procedural integrity in European lawmaking.
What a Permanent Framework Must Deliver
Renew Europe has been explicit about what a durable solution requires: binding obligations on platforms rather than voluntary participation, a dedicated EU Centre with the mandate and resources to coordinate child protection across member states, harmonised detection and reporting standards, and mandatory prevention measures - not just reactive ones. Critically, all of this must be built in compliance with the EU Charter of Fundamental Rights, which guarantees both the protection of children and the right to private communications.
These are not competing objectives. A well-designed permanent regulation can protect children more effectively than the current derogation precisely because it sets enforceable baselines, closes jurisdictional gaps, and does not leave fundamental decisions about privacy to platform discretion. The group's insistence on rejecting the extension is, in this framing, a demand for better child protection - not a retreat from it. The Commission and Council now face clear pressure to return to the negotiating table. How quickly they act will determine whether Europe ends up with a coherent legal framework or a series of rolling temporary exemptions that collectively substitute for one.
