On Thursday, July 9, the European Parliament will vote — again — on whether to let technology companies scan private messages for child sexual abuse material. The vote lands on the last sitting day before summer recess, the procedural equivalent of slipping a note under the door and sprinting for the airport. The European People’s Party, the Parliament’s center-right bloc, secured an “urgent procedure” to bring the measure back after it was rejected in March by a margin of 311 votes against to 228 in favor, with 92 abstentions.

That March vote was supposed to be the story’s end. The temporary CSAM-scanning exemption — the thing activists call “Chat Control 1.0” — lapsed in April. Privacy advocates declared victory. Civil-liberties MEPs gave quotes about the death of mass surveillance. The internet cheered.

And yet here we are, four months later, watching the same legislation shuffle back into the chamber under different voting rules. The conventional reading, already circulating on privacy forums and Hacker News, casts this as a zombie bill — a Brussels horror story in which a surveillance measure refused to stay dead.

That reading is satisfying. It is also wrong about what actually happened.

The March Vote Wasn’t a Win for Privacy Absolutism — It Was a Win for the Center

Look at the numbers. The March rejection wasn’t a radical statement against all scanning. It was a coalition of the unwilling that stretched from the far left to parts of the center-right. The 311 “no” votes included people who want stronger privacy protections and people who simply thought the bill was badly drafted, legally vulnerable, or politically toxic ahead of national elections.

In other words, the bill didn’t lose to ideology. It lost to Brussels’ most reliable force: the dawning realization that something is going to blow up in your face.

That is why the EPP’s procedural gambit this week is less a counter-revolution than a concession. The new version reportedly includes “mandatory detection orders targeting suspects instead of indiscriminate mass scanning” — language that, if you squint, looks an awful lot like the position digital-rights groups were advocating three years ago. The absolutist demand — no scanning, ever, of anything, under any legal framework — lost the public argument so thoroughly that the bill’s own proponents had to adopt the opposition’s framing just to get back in the room.

One legislative aide, standing in the Parliament’s Altiero Spinelli building after the urgent-procedure vote was confirmed, put it this way: “We are voting on a bill that uses their vocabulary. The question now is whether they notice.”

The Real Battle Isn’t Surveillance vs. Privacy — It’s Targeted vs. Blanket

The interesting fight was never about whether scanning should exist. It existed for years under the temporary derogation and nobody outside a few niche policy circles noticed. The fight was about whether scanning would be generalized — applied to every message, every photo, every link sent by every European citizen — or targeted at specific suspects under judicial oversight.

The March vote killed the generalized version. What’s being revived on Thursday is the targeted version, and the privacy movement’s reaction to that fact will reveal whether it’s a movement or a religion.

Religions don’t compromise. Movements win things and then defend them. The targeted-scanning framework, if it passes, will be the first major EU digital-surveillance law in a decade that explicitly rejects bulk collection as a design principle. That is not nothing. It is, in fact, the thing privacy advocates said they wanted.

The risk now is that the movement’s loudest voices — the ones who built followings on platforms by treating every compromise as a betrayal — will denounce Thursday’s vote as Chat Control 2.0 wearing a nicer suit. They will be technically correct that scanning persists and emotionally satisfying to a base that craves purity. They will also be handing the EPP a gift: a chance to say “we offered a reasonable middle ground and they rejected that too.”

The Hardest Thing to Do With a Winning Argument Is Accept a Partial Victory

There is a pattern here worth naming. When a movement succeeds in shifting the terms of debate, it often fails to recognize its own success because the victory arrives in the enemy’s language. The law doesn’t say “we lost, you were right.” It says “we have carefully considered the need to balance child protection with fundamental rights” and then adopts 70% of what you asked for.

Reading that as a defeat is a category error. It mistakes theater for substance.

The EU’s legislative machinery has spent three years grinding through versions of this bill. The version approaching a vote on Thursday is weaker — from a surveillance perspective — than anything the Commission originally proposed. The mass-scanning derogation is dead and nobody serious is trying to resurrect it. The conversation has shifted from “should we scan everyone?” to “how do we target scanning at actual criminals without breaking encryption?”

That second question is genuinely hard. Answering it requires engaging with technical reality, not just tweeting. It requires admitting that some scanning mechanisms — on-device, client-side, before encryption — are not the same thing as a government wiretap room. It requires distinguishing between “the state reading your WhatsApp messages” and “your own phone checking an image hash against a known-CSAM database before it ever leaves your device.”

Conflating those two things has been politically useful. It is also, increasingly, technically dishonest. And the people positioned to lose most from that dishonesty are not the EPP or the Commission. They are the privacy advocates who will be in the room when the next bill is drafted — assuming anyone still wants them there.

Sources