Chat Control: when Parliament revotes until it gets the right result

You won. It was March 25. The European Parliament rejected the extension of Chat Control by 311 votes to 228, the derogation that let platforms scan your private messages was due to expire on April 3, and for the first time in years, the machinery of blanket surveillance of European communications was retreating. You read the news, you may have shared a post, and you moved on. That was the mistake. Not yours. The mistake of believing that, in a democracy, a decision made is a decision that holds.

On Thursday, Parliament revotes. On the same text. With no substantial change. Three and a half months after rejecting it.

The mechanics of the revote

Let us go back over the sequence, because it deserves to be looked at squarely. In March, Parliament rejects the extension of the temporary regime known as Chat Control 1.0, the one that lets Meta, Google or Microsoft voluntarily analyse Europeans' private messages in the name of detecting child sexual abuse material. The rejection was not a whim: MEPs had tried to save the text by limiting it to actual suspects and requiring judicial authorisation, before watching the negotiations with the member states collapse precisely because those safeguards were unacceptable to the Council.

The text is dead. Normally, the story ends there. When Parliament rejects, the Council stops working and the Commission eventually withdraws its proposal. That has always been the institutional grammar of the Union.

Except that this time, the EPP, the largest group in Parliament, decided the result would not do. On June 17, it asks President Roberta Metsola to move the buried file forward. No group formally objects. The next day, Metsola herself presses European leaders to go ahead, against the position expressed by her own assembly. The member states reinstate the measure. And on Tuesday July 7, by 331 votes to 304, Parliament approves an emergency procedure to revote on what it had rejected.

Twenty-seven votes apart. On a procedural question that, in reality, decides everything.

We have seen this film before

Europe has a long practice of revoting until it gets the right result. In 2005, France and the Netherlands reject the European constitutional treaty by referendum. Two years later, the bulk of the content returns under another name, the Lisbon Treaty, and this time the peoples are no longer asked: in France, it is the Congress convened at Versailles that ratifies in February 2008 what the ballot boxes had refused in May 2005. Ireland had said no to Nice in 2001, it was made to revote in 2002. It said no to Lisbon in 2008, it was made to revote in 2009. Denmark had said no to Maastricht in 1992, revote in 1993. The unwritten rule of European construction fits in one sentence: no is temporary, yes is final.

This Thursday is therefore neither a first nor, probably, a last. But there is a difference in kind between putting a treaty back to a vote and putting this text back to a vote. In 2005, what was being forced was a governance architecture, and a badly ratified treaty can always be renegotiated, amended, denounced. What is being forced in 2026 is a surveillance architecture. And an infrastructure that reads the private communications of 450 million people, once in place, is not removed. It waits. It waits for the next attack, the next crisis, the next decree that will broaden its purpose. That is why the stakes of this vote exceed all the precedents: yesterday's revotes changed the way Europe governs itself, this one can change what Europe is. A political space where the state has a permanent right to read everyone's correspondence has a name in the history books, and it is not democracy.

The arithmetic of absence

Because here is the detail almost no one has picked up in the surrounding noise, and which is the real masterstroke. Thursday's vote is not a vote like the others. It is formally a second reading. The text will therefore be adopted by a simple majority of those voting, but to reject or amend it, an absolute majority of all MEPs will be needed: 361 votes.

In March, the opponents had gathered 311 votes. They will need 50 more on Thursday. Thursday, that is, the last sitting day before the summer holidays, when the chamber empties and the diaries close. In this configuration, every absentee votes yes. Silence counts as consent. This is not a metaphor, it is the rulebook.

Add to that the fact that four European commissioners wrote to MEPs on Monday urging them to support the text, and you get the full picture: an institution that mobilised the procedure, the calendar and hierarchical pressure to turn a defeat into a victory, without changing a line of the defeated text.

The institutional decision gap

I have written for years about the decision gap, that gap between the moment an organisation identifies a risk and the moment it acts. Usually I apply it to companies: the CISO who raises the alarm, the committee that takes note, and nothing that moves. What is playing out on Thursday is the inverted version, and it is more worrying still. Here, the decision was made. It was formalised by a vote. And the institution built a mechanism to dissolve that decision, the way you roll back a transaction in a database.

Thursday's subject is no longer really the scanning of messages. It is the value of a parliamentary decision. If a rejected text can come back intact three months later, with voting rules recalibrated to guarantee its adoption, then the March vote was not a decision. It was a poll. And a parliament that produces polls rather than decisions is no longer a check on power, it is a rubber stamp with a latency.

The text's defenders will reply that the stakes justify it: protecting children cannot wait. The argument deserves better than a wave of the hand, and it must be said clearly: no one, among those opposing this text, disputes the objective. What is disputed is the method, this indiscriminate scan whose error rate, vulnerability to circumvention and inability to tell a criminal network from a sext between teenagers security researchers have documented for years. Parliament itself defended an alternative: detection orders targeted at suspects, validated by a judge. It is that alternative that Thursday's revote smothers, by keeping on life support the least effective and most invasive system, the one no one needs to defend on the merits any more since it is now enough to keep it alive through procedure.

Those called conspiracy theorists are simply reading the texts

A word about the context, because it changes the nature of the affair. On July 7, the day of the emergency-procedure vote, another obligation also came into force: to fit every new car sold in the Union with an infrared camera trained on the driver's face, impossible to disable for good. At the same time, the Commission is pressing member states to deploy age verification before the end of 2026, tied to the European digital identity wallet expected on the same timeline, an app presented in April by Ursula von der Leyen with a warning to platforms: no more excuses. And on VPNs, this is not rumour. A briefing from the European Parliament's research service designates them as a legislative loophole to close and considers reserving their use to verified adults. Commissioner Virkkunen, asked about the circumvention of age checks, replied that preventing this circumvention is part of the next steps, and the same parliamentary briefing raises a revision of the Cybersecurity Act to get there. In the United Kingdom, they have already gone beyond declarations: after four rejections of a Lords amendment reserving VPNs for adults, the Commons adopted their own provision, now law, which lets the government impose restrictions by mere secondary legislation, without going back through a real parliamentary debate. England's Children's Commissioner is publicly demanding that age verification apply to access to VPNs themselves. And in March, with no law requiring it, Apple rolled out system-level identity verification on 35 million British iPhones, with browsing filtering enabled by default for anyone who refuses to identify themselves. In November the European Parliament voted a resolution for a digital age of majority at 16, and almost all member states signed the Jutland declaration that goes in the same direction.

None of this is a scheduling coincidence. It is a doctrine, public, documented, that advances in layers: install the identification infrastructure, declare it optional, then legislate on the workarounds. Those who were called conspiracy theorists for months invented nothing. They read the official statements and drew the trajectory from them. Their only approximation is a matter of grammatical tense: they announce in the present what is at the proposal stage. The mandatory passport to browse does not exist today, nor does a general ban on VPNs. But every necessary brick is either in force, or being deployed, or written in black and white in an institutional document, including the brick that locks the emergency exits. When all the pieces of a mechanism are laid out on the table and the official manuals explain how to assemble them, refusing to see the mechanism is not rigour. It is methodological naivety.

And that is exactly why one must be beyond reproach on the facts. Not to spare the institutions. Because the real trajectory, sourceable line by line in their own documents, is more damning than any viral thread. We do not need to exaggerate what they are doing. It is enough to quote what they say.

On Thursday, absence will vote

I do not know how Thursday's vote will turn out. Perhaps 361 MEPs will stay in Strasbourg for one more day to confirm what they had already decided in March. Perhaps not. But whatever the outcome, something has already broken in the sequence: the demonstration is made that, at the European Parliament, a rejection is no longer an end, it is a delay.

And to measure what is really at stake, we must stop looking at each measure in isolation, because that is precisely how they are sold to us. Taken one by one, none seems to change much. Message scanning, that is for the children. The camera trained on your face in the car, for road safety. Digital identity, to simplify your paperwork. Age verification, to protect minors. VPN restrictions, so that none of this can be circumvented. The digital euro, to modernise payments. The carbon market extended from 2027 to your heating and your fuel, for the climate, while the idea of an individual carbon quota circulates in institutional publications and France has already banned its short domestic flights. Each brick arrives with its justification, reasonable, almost friendly, and each, separately, would be defensible.

Put end to end, they describe something else. A space where it is known what you write, what you watch, who you are, what you spend, what you emit and where you move. A space from which nothing escapes and where everything is seen. There is a word for that. A prison. Open-air, admittedly. The largest ones always are.

The Davos Forum had written it in black and white as early as 2016, in its predictions for 2030, before quietly removing the phrase when it became awkward: you will own nothing, and you will be happy. We took it for a provocation. Reread the list above. It was a specification sheet, and on Thursday, Europe votes one more line.