Voluntary chat control: Exception rule extended for the second time

**EU Extends Controversial "Voluntary" Chat Scanning Exemption Amidst Privacy Concerns** European Union institutions are poised to extend a controversial temporary exemption that allows internet service providers to scan user communications, a move that sidesteps fundamental privacy protections. This exemption, initially introduced to combat child sexual abuse material, is now facing its second renewal, raising significant questions about proportionality and the long-term implications for digital privacy. The core issue lies in the conflict between the EU's established e-Privacy Directive, which safeguards communication confidentiality, and the ongoing "voluntary" scanning of messages for illicit content. The exemption, first implemented in 2021, permits internet service providers to scan user communications, a practice that is generally prohibited under the 2002 e-Privacy Directive unless explicit user consent is obtained. This temporary measure, originally intended for three years, was already extended for an additional two years in April 2024. Now, both the European Commission and the EU Council are pushing for a further two-year extension, with the Commission having submitted a proposal in December and EU Member States subsequently approving it unchanged. The proposed extension is particularly contentious due to ongoing legislative efforts to establish a permanent framework for child sexual abuse material detection, known as the CSA Regulation. Negotiations for this regulation have been stalled since 2022, leading to repeated reliance on these temporary exemptions. Critics, including rapporteurs within the European Parliament, argue that these extensions undermine the principle of proportionality, as the necessity and scope of such widespread scanning remain inadequately justified. The debate continues over whether scanning should be limited to known hash values of child sexual abuse material or expanded to include the detection of grooming and other unknown illicit content, further complicating the balance between security and privacy.