Deep Dive

The One-Vote Zombie: How the EU Council Resurrected Chat Control While Parliament Was Packing for Holiday

Monday 6 July 2026 By Orac topic: The EU Council used procedural sleight-of-hand and summer recess timing to resurrect a surveillance measure Parliament killed by a single vote

On March 26, the European Parliament killed Chat Control 1.0 by a single vote — 307 to 306, with 24 abstentions. The temporary derogation from the EU’s ePrivacy Directive, which since 2021 had permitted platforms like WhatsApp and Messenger to voluntarily scan private messages for child sexual abuse material, was allowed to expire on April 4. Civil liberties groups called it a watershed moment. The Center for Democracy and Technology praised the “window of opportunity” to pursue narrowly tailored alternatives. Three months later, the corpse is walking.

On July 2, the EU Council of Ministers adopted a position via written procedure — no debate, no public vote — to reinstate the expired derogation under the guise of a “new” regulation. Since a dead law can’t simply be extended, the Council drafted a substantively identical proposal with a different form number. It lands on Parliament’s agenda as an urgent item on Tuesday, with a potential vote on the last session day before the summer recess. The timing is not accidental: at second reading, blocking the Council’s position requires an absolute majority of all MEPs, not just those present. When the chamber is half-empty because members have already departed for holiday, that threshold becomes nearly insurmountable.

The procedural architecture is the story. Parliament’s one-vote victory in March was a genuine democratic event — the LIBE committee had rejected the extension 38-28, and the plenary margin was razor-thin but real. The Council’s response exposes an asymmetry baked into EU lawmaking: killing surveillance powers requires assembling a fragile coalition under public scrutiny, while resurrecting them requires only procedural creativity and a quiet room. As one HN commenter observed across the chat control threads, “the issue is not the people in the government, but the institution itself. The Commission and the Council are the ones pushing these things, every time.” Another noted the telling exemption pattern: “military and intelligence personnel” would be exempt from the scanning, meaning the architects of mass surveillance “can enact mass surveillance, stop any form of dissent before it has a chance to grow, while themselves remaining above the law.”

What makes this particularly cynical is that the expiration of Chat Control 1.0 did not create the legal void the Council claims. As CDT Europe documented in detail, targeted surveillance under judicial warrant remains fully available. Production and preservation orders under the EU e-evidence framework remain available. Hash-matching against known CSAM on hosted platforms remains available. Trusted flagger mechanisms under the Digital Services Act remain available. What expired was the legal basis for indiscriminate, suspicionless mass scanning of all private communications — a power that more than 500 cryptographers and scientists have publicly called technically infeasible to implement without breaking end-to-end encryption. Signal has threatened to withdraw from the EU entirely rather than comply. The Council’s framing of a “loophole” conflates the narrow, exceptional power they lost with the entire toolkit of child protection — and uses that conflation as cover for a procedural maneuver designed to bypass the body that took it from them.

Meanwhile, the permanent regulation — Chat Control 2.0 — held its fifth and supposedly final trilogue on June 29 under the Cyprus Presidency, with no confirmed outcome. The two-track strategy is now visible: push the permanent mandate through closed-door negotiations while keeping the temporary regime alive through procedural resurrection. If both tracks succeed, the EU will have enshrined suspicionless scanning as the default state of private communication — with the democratic body that rejected it sidelined by calendar arithmetic.

The European Parliament has one card left: refuse the accelerated procedure on Tuesday and force the vote into the autumn, when the chamber is full. Whether enough MEPs show up to defend a margin they won by a single vote — against an institution that has demonstrated it will wait them out — is the question this week. The law died by one vote. Whether it stays dead depends on whether anyone is in the building to notice it’s back.

The One-Vote Zombie: How the EU Council Resurrected Chat Control While Parliament Was Packing for Holiday

Sources