Europe Voted No. Brussels Counted It as Yes.

What is a democratic majority worth when the people who didn’t vote can outweigh those who did?

On 9 July 2026, 314 Members of the European Parliament voted to reject the Council’s position on the attempted revival of Chat Control. Only 276 voted against rejection. The rejection failed.

The explanation is procedural. At second reading, Parliament needed an absolute majority of all MEPs to stop the Council position, which meant reaching 360 votes. The 314 representatives who actively opposed the measure therefore lost not to a larger group supporting it, but to a threshold that allowed abstentions and empty seats to carry more political weight than opposition.

Seventeen MEPs abstained. More than one hundred didn’t vote. They didn’t need to place their names beside Chat Control to help it survive. They merely needed to stay silent while the people who showed up and voted against it fell short of a number Brussels had already decided would be necessary. That should disgrace every MEP who was absent, abstained or treated the confidentiality of European communications as something that could be left to colleagues. When the threshold demands active opposition, cowardice becomes support and indifference becomes a legislative weapon.

The European Union likes to present itself as the global custodian of democracy, human rights and the rule of law. Its officials lecture foreign governments about representative legitimacy while constructing a system in which 314 can lose to 276 without a single ballot being hidden. The votes are counted correctly, the result is published openly and the smaller side still gets what it wanted.

Nobody needed to rig the election because the procedure had already decided how much winning was worth. This is the democratic model Brussels increasingly offers its citizens. You may vote, provided your majority clears the correct institutional obstacle. You may object, provided enough other representatives abandon their holidays, party instructions and political cover to object alongside you. You may win the visible contest, while the machinery underneath preserves the outcome you voted to stop.

Chat Control is supposed to be about identifying threats hidden inside private communications, and generally discussed as a conflict between privacy and child protection. Before reaching that argument, however, there is a more basic question. What does it mean to win the vote when winning isn’t enough to produce the result? On 9 July, it revealed something else hiding inside the European project: a governing class that considers public consent important enough to perform, but not important enough to obey.

Europe voted no. Brussels counted the votes and carried on.

‍

How No Became Yes

The 9 July result didn’t just materialize out of thin air. Brussels spent the previous four months shopping for a procedure that would let Chat Control survive after Parliament had already told it to sod off.

On 11 March, MEPs supported a narrower extension that would have restricted scanning and strengthened privacy protections. Negotiations then collapsed because the Council would not accept Parliament’s position. When the proposal returned to the chamber on 26 March, Parliament rejected the extension outright by 311 votes to 228, with 92 abstentions. The temporary exemption expired on 3 April. In a functioning democracy, that would normally be understood as an answer. Brussels understood it as a scheduling problem.

The Council cooked up its own version and sent the file back for a third vote in four months. This time, the proposal arrived at second reading, where rejecting or amending it required an absolute majority of every sitting MEP (360 votes). The political question hadn’t really moved, but the arithmetic required to stop it had been made deliberately harder. Then they pulled the urgent procedure card. Instead of sending it back to committee where people could actually pick it apart and build a cross-party position, Parliament fast-tracked it and dumped the decisive vote on Thursday 9 July, the final plenary day before the summer recess. The next sitting wasn’t until mid-September. Perfect timing if you want the room as empty as possible.

More than a hundred MEPs didn’t bother showing up. Some were already on holiday, some were heading home, some just couldn’t be arsed to defend their constituents’ private messages. The effect was the same either way. Every empty seat made the 360-vote threshold that little bit further out of reach and let the Council position survive without its supporters ever having to win a straight majority.

This is how no became yes. The Council didn’t return with an argument persuasive enough to convert Parliament. It returned with a procedural position that made conversion unnecessary. Supporters of Chat Control no longer needed to assemble more votes than its opponents. They needed only to run down the clock, force the vote onto the weakest day of the parliamentary calendar and rely on enough MEPs failing to appear.

Europe has seen this kind of arithmetic before. In Scotland’s 1979 devolution referendum, 51.6% of participating voters supported creating a Scottish assembly, but the proposal failed because the law required yes votes from at least 40% of the entire registered electorate. Those who stayed home were not officially counted as voting no, yet their absence helped defeat the people who voted yes. The constitutional settings were different, but the trick performed by the threshold was the same. A numerical majority existed, while the legally decisive majority didn’t.

Enhanced thresholds can serve legitimate purposes, especially when Parliament is overturning a Council position at second reading. But Brussels cannot hide behind a civics lesson after engineering the vote under the conditions most favourable to the outcome it wanted. The same Parliament had rejected the extension in March. The derogation had expired in April. Instead of accepting either result, EU institutions revived the file, accelerated the timetable and placed it before a depleted chamber on the final day before recess, knowing that every absent MEP would strengthen the side asking for nothing more than continuation.

‍

The Law That Refused to Die

Chat Control was sold as temporary. The original ePrivacy derogation dropped in 2021 as a limited, voluntary carve-out letting some providers scan messages for child sexual abuse material. Just a short bridge, they said, while they worked on a proper framework. Governments love that word. Bridge. It is what they call powers they want right now but have not yet guilt-tripped everyone into accepting forever.

They extended the bridge in 2024. When it finally expired on 3 April 2026, the permanent regulation was still nowhere near ready. That should have been game over for the temporary regime. Instead, its expiry became the perfect excuse to bring it back to life. The Commission proposed another extension, Parliament rejected it in March, and the Council returned with its own version in July. The measure had expired in law and lost a parliamentary vote, yet Brussels treated its disappearance as a gap to be repaired rather than an outcome to be respected. This is how temporary power becomes permanent without anyone ever having the balls to announce the plan out loud.

The exemption returns because the permanent legislation isn’t ready. The permanent legislation remains unfinished because its most controversial questions remain unresolved. The continued existence of the exemption then reduces the pressure to resolve them, because providers and regulators can keep operating under the bridge. Temporary justifies renewal, and renewal keeps temporary alive.

Britain demonstrated the same institutional reflex through its Prevention of Terrorism laws. The first statute arrived in 1974 carrying the reassuring title “Temporary Provisions”. It was renewed and replaced repeatedly until much of the architecture was consolidated into permanent legislation in 2000. The powers remained temporary in roughly the same way that a hotel room remains temporary after you have lived there for 25 years.

The comparison isn’t about equating terrorism legislation with child-abuse detection. The parallel lies in what institutions do once an exceptional mechanism becomes administratively useful. They stop asking whether it should exist and begin asking how to prevent it from lapsing. Chat Control 1.0 has crossed that psychological boundary. Its supporters no longer describe expiry as the return of ordinary communications confidentiality. They describe it as a dangerous vacuum that must be repaired. The exception has existed long enough for its absence to feel exceptional.

That matters because the permanent proposal has also changed shape. The Council removed the Commission’s original mandatory detection orders, but retained risk assessments, mitigation duties, voluntary detection, age assurance, a new EU Centre and a future review that could reopen the question of compulsory scanning.

The most dystopian version of Chat Control may have retreated. The infrastructure surrounding it hasn’t. A temporary scanning exemption normalizes the idea that private communications may be inspected for a sufficiently important purpose. Risk classifications normalize platforms having to prove they are managing what users send. Age assurance normalizes access depending on proof that someone belongs on the permitted side of the line. A central body maintaining indicators and receiving reports inserts another institutional layer between private communication and its intended recipient.

Each component can be defended as narrow and necessary. Together, they create a system in which private communication is no longer treated as a space government must justify entering, but as regulated infrastructure whose inspection rules are negotiated above the user. That is why expiry was never going to be enough.

Once providers, regulators and police build procedures around the system, switching it off becomes politically harder than keeping it alive. Nobody wants to be accused of creating a gap in child protection, even when the “gap” is simply the return of normal privacy protections. That is how temporary measures survive: through a sequence of “reasonable” decisions made by people who never want to be responsible for ending them.

‍

Voluntary for Platforms, Not for You

The word doing most of the political heavy lifting in Chat Control is voluntary. The temporary derogation doesn’t currently require every provider to scan every message. It simply gives eligible companies legal permission to analyze private communications for child sexual abuse material even though normal confidentiality rules would block it. Parliament’s July amendments also seek to exclude communications protected by end-to-end encryption.

That sounds reassuring until we ask who is actually volunteering. The provider may choose to deploy the detection system, and Brussels may provide the legal cover, but the person whose messages, photographs and attachments enter that system has made no comparable choice. The decision has been transferred upwards, from the individual communicating to the company carrying the communication.

This isn’t merely a question of who owns the phone. It concerns privacy, individual liberty and the practical meaning of sovereignty. A free individual should be able to communicate without every private exchange becoming a potential object of institutional analysis. Privacy isn’t simply the absence of somebody reading a message. It is the freedom to think, speak, associate and reveal parts of yourself without first calculating how a platform, algorithm or regulator may interpret them.

Once that freedom depends on the discretion of a provider, it is no longer a right exercised by the individual. It becomes a permission granted by infrastructure. Anyone who understands Bitcoin already understands the distinction. A balance displayed inside an exchange account may be described as yours, but if another party can freeze it, censor a withdrawal or deny access, then the user possesses a claim rather than genuine control. Sovereignty begins where institutional discretion ends.

The same principle applies to communication. Your phone may remain legally yours while its software analyses what you write before allowing the message to leave. Encryption may remain mathematically intact while the plaintext is examined at the endpoint. The service can continue advertising privacy even though the practical conditions of that privacy are being negotiated between the platform and the regulator.

The interface may still say private, while the architecture makes privacy conditional. That matters because surveillance changes behaviour even when nobody is actively watching a particular person. When users know that intimate conversations, family photographs or medical discussions may be evaluated by software searching for criminal material, the boundary between private life and regulated space begins to disappear. People become more cautious, less candid and increasingly aware that communication takes place inside systems whose rules they neither wrote nor control.

The permanent proposal extends the same logic. Although the Council removed the Commission’s original mandatory detection orders, it retained risk classifications, mitigation duties and voluntary detection. A service classified as high-risk may need to prove that it is doing enough to satisfy regulators, while scanning remains available as a recognized form of mitigation. The law may never need to state explicitly that a provider must scan or face punishment. It can simply make scanning easier to defend before regulators, lawyers and shareholders than any alternative. Refusing to inspect communications then becomes the decision requiring repeated justification.

This is how liberty is narrowed in modern Europe. The state doesn’t always need to prohibit speech, seize a device or operate the scanner itself. It can regulate the platform, define the risk and allow corporate compliance departments to impose the conditions under which private communication remains available.

Comparing an uploaded file with a fingerprint taken from material already confirmed as illegal is relatively narrow. Asking an algorithm to classify an image it has never encountered is considerably more uncertain. Asking software to infer grooming from language, age, relationships and context goes further still, because it requires a machine to interpret private human interaction rather than identify a known file.

A false alert doesn’t merely produce an irrelevant recommendation. It can expose private photographs and conversations to company reviewers, reporting bodies or police while attaching one of the most destructive suspicions imaginable to an innocent person. Human review doesn’t restore the privacy that was lost; it introduces another stranger before the system decides that the machine was wrong.

Bitcoin teaches a lesson that reaches far beyond money: sovereignty doesn’t mean being allowed to use something under conditions chosen by somebody else. It means retaining meaningful control over your property, your communications and the boundaries of your private life. Chat Control pushes Europe in the opposite direction. The message may be yours, the encryption keys may remain on your device and the phone may sit in your hand, but your freedom to communicate privately increasingly depends on decisions made by platforms and institutions above you.

The real question is therefore larger than whether a message remains technically encrypted. It is whether privacy still belongs to the individual, or whether it has become another service Brussels permits under supervision. As we explored in Your Government Has a Churn Problem, some jurisdictions are learning to compete for mobile people, while others are responding by making life more documented, expensive and difficult.

‍

Surveillance Before Suspicion

The deeper problem with Chat Control isn’t only that private communications may get analyzed. It is that the order of justice is being flipped on its head. Surveillance used to follow suspicion. Authorities picked a person, built real grounds for concern, and then went to court for permission to look. The burden sat on the state because privacy belonged to the individual by default.

Chat Control starts from the opposite end. Communications belonging to people suspected of nothing get processed so the system can fish for who might deserve suspicion. Instead of investigating a person because evidence exists, it sweeps the population hoping evidence will pop out. That distinction cannot be rescued by calling the process automated. Whether the first judgement is made by an investigator or an algorithm, the private material has already been examined before any case against its owner exists. Innocence is no longer the reason to leave someone alone; it is a conclusion the system may reach after entering their private life.

This is how exceptional surveillance becomes ordinary infrastructure. There is a shift from whether the state has grounds to inspect a person to whether enough safeguards surround the system inspecting everyone. Privacy ceases to be the boundary that power must cross and becomes a promise about how responsibly power will behave once it is already inside. The danger goes way beyond false positives, though those can wreck lives. The deeper loss is the basic idea that a free person should not have to walk through an inspection machine just to send a message. Once universal processing becomes normal for one serious crime, the debate is no longer about whether the architecture should exist at all. It becomes about which new harms are serious enough to plug into it next.

Today, the legal justification is child protection, and the material being targeted is among the most abhorrent imaginable. That is precisely why the architecture is so easy to establish. Few politicians want to be accused of defending privacy at the expense of abused children, and few platforms want to explain why they refused a tool presented as capable of preventing harm. But surveillance systems don’t remain loyal to the moral urgency used to introduce them. They search for whatever governments, regulators and platforms later decide should be found. Once private communications can be analyzed at scale, expanding the categories no longer requires constructing a new system. It requires changing the list.

How long before the scanner is asked to look for extremist language, misinformation, hate speech or whatever new category of harmful content enters the political vocabulary? A controversial opinion written in anger, an offensive meme sent to a friend or an edgy joke dropped into a private group chat could be stripped of tone, context and familiarity, then interpreted by a model designed to detect danger rather than understand human beings.

By the time a person explains that the threat was sarcasm, the meme was satire or the offensive sentence was shared between friends who understood the joke, the message may already have been flagged, retained and reported. An algorithm doesn’t need to convict you to damage your life. It only needs to create a suspicion serious enough for institutions to start treating you differently.

This is how surveillance begins to shape speech without banning it. People become cautious in private, soften opinions they once would have tested honestly and stop sharing anything that could look dangerous when removed from its original setting. The group chat becomes another public square, except the audience is invisible and the rules can change after the message has been sent. Freedom of speech cannot survive for long without private spaces in which people are allowed to be clumsy, offensive, experimental and wrong. Once every conversation becomes potential evidence, liberty is replaced by the permanent obligation to sound innocent.

‍

The Net Tightens

Chat Control isn’t an isolated excess. It is one part of a European system that is making the individual progressively more legible to institutions while making independent action harder to exercise outside them.

By the end of 2026, every member state must make an EU Digital Identity Wallet available to citizens, residents and businesses, while public authorities will be required to accept it. The Commission is also encouraging the deployment of an age-verification application that can operate independently or be integrated into those wallets. Use may be voluntary today, but once a common identity rail connects government services, banks, mobile providers and online platforms, expanding the situations in which people are expected to prove who they are becomes considerably easier.

The same perimeter is tightening around Bitcoin. MiCA’s final transitional period ended on 1 July 2026. After that date, providers serving EU clients could no longer operate without the required authorization. The Transfer of Funds Regulation requires personal information to accompany transfers involving regulated crypto providers. For transfers above €1,000 involving a self-hosted address, it requires verification that the customer owns or controls that address. Bitcoin itself remains permissionless, but the on-ramps and off-ramps most Europeans use now demand identification, records and regulatory approval.

Brussels is also studying net wealth, capital and exit taxes, including the administrative systems needed to identify assets, value them and preserve a claim when people or capital move elsewhere. We examined that machinery in greater detail in The Signal Most People Will Ignore, including why Bitcoin holders should pay attention long before a research paper becomes a tax bill.

This isn’t yet a single EU tax proposal, but it shows that institutional attention is reaching beyond what citizens earn and spend towards what they already own and what claim the state may retain when they or their assets leave. They will insist that each file has a separate purpose, and legally it does. Digital identity offers convenience, MiCA promises consumer protection, financial surveillance is presented as anti-money laundering, Chat Control invokes child safety, and wealth taxation arrives dressed as fairness.

Viewed separately, every measure appears narrow. Viewed together, the direction is unmistakable: less anonymity, less private space, more monitoring and more institutional control over how Europeans communicate, transact and move. From the perspective of individual sovereignty they all move the boundary in the same direction. The citizen becomes easier to identify, the message easier to inspect, the transaction easier to trace, the private wallet easier to connect to a legal identity and the decision to leave harder to separate from the tax authority’s reach.

This is how the net tightens without any single law appearing to close it. Brussels can’t ban self-custody but it can regulate every useful gateway around it. It doesn’t need to abolish private communication when it can give platforms permission to inspect it. It doesn’t need to forbid people from leaving when it can study how much of their wealth should remain taxable on the way out.

The European Union increasingly wants citizens to be transparent, traceable and taxable from every angle, while continuing to describe each new checkpoint as a service provided for their benefit. Bitcoin stands apart because the protocol cannot be ordered to identify its users or reject a valid transaction for lacking the correct paperwork. That is why pressure moves towards exchanges, banks, devices, applications and jurisdictions instead. When Brussels cannot control the asset, it controls the perimeter around the person holding it.

This is also why we treat self-custody, privacy, cybersecurity and jurisdictional planning as parts of the same problem. They aren’t separate lifestyle upgrades. They are the practical foundations of remaining sovereign while institutions work to make every route outside their control narrower, more visible and more expensive.

‍

Europe’s Permissioned Citizen

Europe doesn’t need to abolish your freedoms when it can make each of them conditional.

You may still send the message, provided the platform accepts how it was sent. You may still hold Bitcoin, provided the regulated gateway can identify you and trace where the funds are going. You may still move your wealth, provided the tax authority has finished deciding what claim it retains when you leave. You may still elect representatives, provided their majority clears the procedural threshold required to matter. The freedom remains on paper. The permission sits underneath it.

That is the permissioned citizen: formally free, yet increasingly dependent on institutions capable of identifying, inspecting, delaying or overruling every important action. The state doesn’t need to prohibit everything directly when it controls the platforms, banks, licenses, devices and identity systems through which modern life is conducted.

Bitcoin offers a rare exception because its rules don’t change according to the political mood in Brussels. A valid transaction does not require a license, a parliamentary majority or an explanation of why the recipient deserves to receive it. The network verifies the rules and settles the transfer.

Yet buying Bitcoin alone doesn’t make someone sovereign. Bitcoin left on an exchange remains exposed to the custodian. A hardware wallet backed up carelessly can turn independence into permanent loss. Private keys offer little privacy when the owner’s identity, devices and transactions remain connected through the same services. Someone may escape one financial intermediary while remaining dependent on a bank, cloud account, mobile provider and single jurisdiction for everything else.

Sovereignty isn’t a product purchased once and forgotten. It is the competence to control your money, protect your communications, secure your devices and reduce the number of institutions whose permission your life depends upon.

That is the work at the heart of what we do. Self-custody matters because nobody else should decide whether you can access your money. Cybersecurity matters because private keys are only as safe as the systems surrounding them. Private communication matters because liberty becomes fragile when every candid thought can be inspected or reinterpreted. A Plan B matters because sovereignty remains incomplete when one bank, platform or government can still close every available door.

This doesn’t require disappearing into the mountains or living in permanent fear of the next regulation. It means building enough resilience that a frozen account, compromised phone or hostile policy cannot place your entire life at somebody else’s mercy. Brussels will continue presenting each checkpoint as a reasonable intervention. The digital identity will be convenient, the licensed exchange will be safer, the scanner will protect children, and of course the new tax will promote fairness. No single measure will be announced as the end of privacy or sovereignty.

The net tightens one reasonable step at a time. Freedom must be built with the same patience. You cannot control what Brussels votes on next, but you can reduce how much authority its decisions hold over your life. You can take proper custody of your Bitcoin, secure your devices and communications, understand the information you expose and build a practical alternative before you urgently need one.

Book a free, 30-minute introductory call with one of our advisors and begin turning sovereignty from an idea into something you can rely on. Europe voted no, and Brussels carried on. Your answer should not depend on whether it listens next time.