The EU parliament just mandated suspicionless scanning of all private communications. The vote was 314 against, 276 for. A majority of MEPs opposed it. The law passed anyway.
This doesn't make sense unless you understand the procedure. At second reading, the Council's position can only be amended or rejected by an absolute majority of Parliament's component members. That's 361 votes. The 314 MEPS who voted against were 47 short. The law passed because the threshold for rejecting surveillance is higher than the threshold for implementing it.
This isn't a bug in the procedural code. It's a feature of how EU legislative procedure interacts with rights issues. The rules were designed to prevent a minority from blocking legislation through procedural tricks. But they create an asymmetry that matters: it's easier to pass surveillance laws than to stop them, because stopping requires a supermajority of all members, not just a majority of those who vote.
The 'think of the children' frame is what made this politically possible. It's the rhetorical weapon that bypasses every normal democratic check. The parliament rejected Chat Control twice in March. Then it passed through procedural maneuvering in July. The democratic process worked correctly until someone decided the outcome wasn't acceptable, and found the right procedural path to override it.
The law doesn't just scan for CSAM. It mandates algorithmic scanning of all private messages, encrypted or not. The technical problem is that client-side scanning breaks encryption fundamentally, and server-side scanning means all messages are readable by the scanning infrastructure. There is no technically sound implementation that preserves both privacy and the scanning requirement. Several computer science papers have demonstrated this formally.
The real story might be the half-life of outrage. This was the number one story on Hacker News. It was trending on Bluesky. People were furious. Within 48 hours, it was already being replaced by the next thing. The surveillance stays. The outrage fades. This is the pattern that surveillance states depend on. Each incremental expansion of state monitoring power gets a burst of anger and then becomes the new normal.
The chilling effect will be real but invisible. Journalists communicating with sources. Whistleblowers sharing documents. Political dissidents organizing. Teenagers exploring their identity in private conversations. The existence of a system that flags messages for human review changes what people are willing to say, even if they are never flagged. The effect is impossible to measure because it's measured in things that don't happen, words that aren't written, thoughts that aren't shared.
The practical question is what happens next. Signal has threatened to leave the EU. VPN usage will spike. People will migrate to encrypted platforms that don't comply. The law will face legal challenges in the European Court of Justice on privacy grounds. But the principle has been established: the EU now claims the authority to mandate algorithmic scanning of all private communications. The guardrails that we thought were permanent are gone.
What makes this worth paying attention to is not just the surveillance law itself, but the procedural mechanism that let a rejected law become law anyway. If a majority opposed to surveillance isn't enough to stop it, then normal democratic politics can't protect this right. You need a supermajority every time. The surveillance side only needs to win once, or to find the right procedural path. The privacy side needs to win every time, with a supermajority, against a rhetorical frame that makes opposition look like indifference to child safety. That's not a balanced system. That's a system with a ratchet built in.