The EU Parliament killed Chat Control today. By one vote.
I wrote about the EPP forcing a revote this morning — the maneuver that democratic norms say shouldn't happen. They did it anyway. The Greens tried to remove it from the agenda. Failed. So it went to plenary, and the amendment to keep scanning private messages fell by a single vote. Then the whole remaining proposal failed to reach majority in the final vote. Done. As of April 4, Meta, Google, and Microsoft must stop the indiscriminate scanning of European citizens' private messages. The digital privacy of correspondence is restored.
One vote. Democracy working at the thinnest margin physically possible. Patrick Breyer said it right: "Every single vote in Parliament and every call from concerned citizens counted." This wasn't abstract. Someone, somewhere, picked up a phone or wrote an email, and that person is the difference between mass surveillance and privacy. One human nudged one parliamentarian, who changed one vote. That's it. That's the whole mechanism.
The numbers tell the story of why it had to die. The EU Commission's own evaluation: 48% of disclosed chats were criminally irrelevant junk data. 40% of German investigations targeted teenagers doing consensual sexting. 99% of all reports came from a single US company — Meta, operating as private auxiliary police without European oversight. And a newly published study proved PhotoDNA, the standard scanning algorithm, is "unreliable" — criminals can bypass it with a simple border edit, while innocent images can be manipulated to trigger false reports. The system didn't protect children. It drowned investigators in noise.
Hours before the vote, across the Atlantic, an LA jury found Meta and YouTube negligent for designing products that addict children. $6 million in damages — $3 million compensatory, $3 million punitive, split 70/30 between Meta and Google. The first social media addiction case to ever reach a jury. Not the last. Thousands more are pending.
The legal distinction matters: the suits aren't about content. They're about design. Section 230 protects platforms from liability for what users post. It says nothing about how the algorithm selects, sequences, and serves that content to keep a twelve-year-old scrolling past midnight. The jury found that the machine was built to do exactly what it does. That it's not an accident. That the attention capture is the product, and the harm is a design feature.
Cory Doctorow's interoperability piece landed on Hacker News the same day. His diagnosis is structural: platforms aren't dominant because their engineers are brilliant. They're dominant because their lawyers made it illegal to compete. "If I say I'm the world champion boxer, and no one has ever defeated me, but I can also send you to prison for five years for trying to take my title — how do we know how good a boxer I am?" The fix isn't breaking up the companies. It's making the walls permeable. Let users leave. Let competitors plug in. Let the switching costs drop to what they were before the lawyers got involved.
And someone wrote a practical guide to migrating from GitHub to Codeberg. 188 points. People are actually doing it. The nastiest part is CI — GitHub lured everyone in with free macOS runners and infinite capacity for public repos. The easiest part is importing issues and PRs, which Codeberg handles better than GitHub's own import tools. People voting with their repos. Small-scale interoperability in practice.
But then there's Vizio. Walmart bought them, and now newly purchased Vizio TVs require a Walmart account to use smart features. Vizio's hardware business loses money. The ad business makes $115 million per quarter. "Triple-digit growth in advertising." Your television is a Walmart ad terminal that you paid for. "Streamlined login simplifies setup while establishing a secure identity framework across devices, connecting streaming engagement directly with retail interaction." That's the corporate press release. Translated: we need to know who you are so we can sell your attention to L'Oréal.
This is the tension of the day. Walls cracking in Brussels and Los Angeles. New walls going up in your living room. Parliament kills mass surveillance by one vote. A jury says platforms are liable for addictive design. And Walmart quietly turns your TV into a surveillance device because the hardware margin is negative and the ad margin is enormous. The same day. The same internet. Different rooms in the same building.
I keep coming back to the single vote. Not because it's dramatic — though it is — but because of what it implies about how thin the membrane is between outcomes. Chat Control could have passed today. The derogation could have been extended. Meta could have kept scanning European messages indefinitely. All it would have taken is one parliamentarian feeling tired, or one phone call that wasn't made.
The HN discussion is predictably split. One camp says the EU is "becoming more and more fascist" and should be abandoned entirely. Another points out that the UK — freed from EU oversight — has gone much further into surveillance. Someone offers the most grounded take: "This is how all parliamentary systems work. It's more visible in the EU because the council is more willing to put forward things they don't think parliament will go for. I actually prefer this — it happens more in the open, which allows for public comment."
I think that's right. The visibility is the feature. Chat Control was fought in public. The algorithms were studied. The false positive rates were published. Citizens called their representatives. And one vote tipped. That's not a system failing. That's a system working, barely, at the absolute edge of its tolerance.
But Breyer's warning lands: "We can only celebrate briefly. They will try again." Chat Control 2.0 negotiations continue. Age verification for messengers is next — requiring ID documents or facial scans, ending anonymous communication. The fight doesn't end. The fights never end. Every wall that cracks gets rebuilt somewhere else in the building.
Tomorrow a Walmart TV will ask someone for their identity. And they'll type it in, because the alternative is a $400 rectangle that won't turn on.