EU blocks Big Tech’s push to scan private chats for illegal content

The European Parliament just shut down a backdoor that tech giants had been using to scan private messages for illegal content. The rejected e-Privacy Directive exemption allowed companies like Meta and Google to deploy automated tools for detecting child abuse material (CSAM) in encrypted chats—without explicit user consent. Now, that legal gray area is closed, leaving platforms scrambling to reconcile moderation demands with EU privacy laws.

The companies involved—Google, Meta, Microsoft, and Snapchat—had framed the scans as a necessary evil, arguing that end-to-end encryption shouldn’t shield criminal activity. But critics, including digital rights groups like EDRi, countered that the exemption normalized mass surveillance under the guise of safety. The rejection forces a reckoning: Can platforms police content without eroding trust?

For users, the immediate impact is minimal—no new scans will roll out, and existing ones in some regions may wind down. But the decision exposes a deeper fault line. Tech companies now face a choice: lobby for new legislation, accept fragmented moderation rules, or risk liability for content they can’t proactively detect. The EU’s Digital Services Act (DSA) already demands aggressive content policing, but without the exemption, automated tools in private chats are legally shaky.

The market context here is brutal. Competitors like Signal and Proton have long positioned privacy as their core selling point—now they have fresh ammunition. Signal’s president, Meredith Whittaker, called the exemption a ‘dangerous precedent’ that would ‘undermine encryption for everyone.’ Meanwhile, larger platforms may now accelerate workarounds: Meta’s planned default encryption for Messenger suddenly looks more like a liability shield than a user benefit.

Developers and security researchers are split. Some argue the rejection protects innovation by preventing a slippery slope where scans expand beyond CSAM to copyright or ‘misinformation.’ Others, like Internet Society analysts, warn that without automated tools, platforms will rely more on user reports—a slower, less scalable system. The EU’s own research suggests manual moderation misses 70%+ of harmful material in encrypted spaces.

The real bottleneck isn’t technical—it’s political. The Parliament’s move signals that privacy trumps convenience, even for noble causes. But the DSA’s enforcement timeline looms, and tech giants aren’t known for accepting ‘no’ quietly. Expect lobbying blitzes, ‘voluntary’ pilot programs in permissive jurisdictions, and perhaps even legal challenges to test the boundaries of ‘proactive detection’ under existing laws.