The European Parliament has voted to extend legislation allowing tech companies to voluntarily scan users’ private messages for child sexual abuse material, despite a majority of lawmakers voting against the proposal.

The ruling reinstates permissions for firms including Meta, Google, and Microsoft to scan private text, email, and social media messages through a bill nicknamed “Chat Control” by critics. End-to-end encrypted chats, such as those on WhatsApp and Signal, remain exempt.

“It will mean that private companies may deny your right to have confidential digital conversations,” Simeon de Brouwer, policy advisor at Brussels-based advocacy group European Digital Rights tells WIRED, “they could, if they want to, read every message you write, every email you send, every picture you share.”

The European People’s Party, the largest political group in European Parliament, has been battling to bring back tech firms’ legal basis to scan messages since a prior law expired in April. Members say firms’ voluntary detection activities have helped identify and rescue victims of online child sexual abuse, and disallowing them leaves children unprotected. They have been rushing to reinstate the legislation before parliament disperses for its summer break at the end of the month.

“We cannot go to the summer recess knowing that our children are not protected,” party vice-chair Tomas Tobé told lawmakers earlier in the week.

But the implications for privacy means the legislation has faced fierce opposition from other parties and civil rights activists. The EPP resorted to a procedural manoeuvre to force fresh votes on this legislation this week after talks collapsed in March. This “urgent procedure” skips preliminary committee debates where amendments would often be introduced and stipulates that the regulation passes unless an absolute majority of 361 MEPs vote against it.

While more Members of the European Parliament voted against the regulation on Thursday than voted for it, they fell short of that majority by 47 votes. Tech companies will now retain that right to scan messages for child sexual abuse detection until 2028, or until permanent legislation – in discussion and already dubbed “Chat Control” by critics – replaces it.

Civil rights activist and former MEP Patrick Breyer called the ruling a “farce” which “damages democracy”.

“Our children are the real losers in this undemocratic process,” according to a blog post by Breyer. “Trying to protect children with suspicionless mass surveillance is like frantically mopping the floor while the faucet is still running. Blanket chat control is just as unacceptable as indiscriminately opening everyone’s physical mail.”