News

Last week, as European lawmakers packed their bags for the summer recess, a controversial surveillance law was quietly brought back to life. It's the latest plot twist in the struggle to find a balance between digital privacy and children's safety.

Through an unusual procedural loophole, the European Parliament revived what’s been dubbed "Chat Control 1.0." It's a temporary rule that allows tech giants like Meta, Google, and Microsoft to voluntarily scan citizens' unencrypted private messages in search of child sexual abuse material (CSAM).

While the law — which is expected to officially pass once MEPs return from summer recess — excludes end-to-end encrypted apps like Signal and WhatsApp, its resurrection has sent shockwaves through the digital rights community.

Critics have not only slammed the revival procedure as "undemocratic," but also warned that it could mean mass scanning becomes permanent.

Central to the debate is whether Big Tech should use mass scanning (where everybody's data is checked) or targeted scanning (where only people identified as potential suspects are affected).

And while the European Parliament decided to reject mass scanning in March in favor of a "proportional and targeted" approach, last week’s vote represents a major U-turn that brings it back to the table.

But how did a law voted down over three months ago end up on the fast track to be enforced? And what will be the lasting impact on our privacy?

Due to the "rarely used" legal procedure adopted last week, an absolute majority was required to reject the proposal.

This meant at least 361 MEPs were required to vote against it — something critics say was difficult to achieve as many of them were already on holiday.

So, despite the majority of MEPs rejecting it (314 against, 276 in favor), the motion was sent to the Council for final approval, which is expected in September.

Initially intended as a stopgap while lawmakers debated the permanent Child Sexual Abuse Regulation (CSAR) bill — aka Chat Control 2.0 — the interim framework was in place from 2021 until it terminated in April of this year.

Since then, child safety groups and some MEPs have argued that the legal vacuum this caused required urgent action — a gap addressed by last week's vote.

However, Google, Meta, Microsoft, and Snapchat issued a joint statement in April pledging to "continue to take voluntary action" to execute CSAM scans — regardless of whether the interim scanning law was enacted.

Many critics didn’t like how the Chat Control gambit unfolded, calling EP President Roberta Metsola's actions a political stunt. They allege she used a legal loophole strategically to schedule a vote during the final meeting of the legislative season to maximize its chances of passing.

A long-standing critic of the CSAM scanning law, former MEP for the German Pirate Party and digital rights jurist Patrick Breyer didn’t mince words, slamming Metsola's move as a "farce" that "damages democracy."

Robin Wilton, the Internet Society's Senior Director for Internet Trust, also told TechRadar that the "extraordinary bending of parliamentary procedure" required to pass the bill should concern everyone.

In a written statement to TechRadar, Roberta Metsola’s press office said, "it was not the President who brought this up or pushed for it" but that the issue was raised by other political groups during a meeting in June.

While the temporary legal framework is expected to be reinstated soon, the more significant battle over CSAM scanning and digital privacy continues in the background.

Lawmakers are still discussing the terms of the permanent CSAR law, with negotiations reportedly stalling over the issue of targeted or mass scanning.

Critics are now concerned that last week's vote could steer the direction of the debates regarding the permanent law. And not in ways that would protect people's digital privacy.

Rand Hammoud, Director of the Security, Surveillance and Human Rights Programme and Regional Encryption Lead at the Center for Democracy and Technology (CDT), fears that passing the temporary law risks legitimizing mass scanning and says that opposition may become "more difficult" to sustain.

Put simply, because the temporary law allows for mass scanning, the permanent legislation may be more likely to include the same provision.

Some technology researchers have warned that mass scanning may lead to a surge in false positives. While some groups may view these errors as an inevitable part of any technology that can be fixed, Belgian cryptographer Bart Preneel — the author of multiple research papers on this matter — warns it could take at least two years to develop a better solution.

Digital rights advocates have long argued that mass scanning is a privacy "disaster waiting to happen," calling for more targeted solutions. They believe that even when the scanning is "voluntary" — meaning when tech companies can choose whether to perform the scanning or not — it remains problematic.

For child safety groups, however, voluntary scanning is non-negotiable. According to Hannah Swirsky, the Internet Watch Foundation's (IWF) Head of Policy and Public Affairs, it would be a mistake to limit detection only to individual suspects.

"The scale of the issue with CSAM requires technology to be used widely across platform systems," Swirsky told TechRadar.

Either way, Hammoud from CDT Europe says finding the right balance between privacy and children's safety "demands careful, evidence-based lawmaking" — a standard she argues was lacking in the fast-tracked procedure last week.

Despite the temporary law expected to officially pass in autumn, some opponents of Chat Control are still hopeful.

Crucially, the vote showed that most MEPs remain unconvinced about the current legal framework being developed. And while there is deep disagreement on how to do so effectively, it is worth noting that people on all sides want to find solutions that keep children safe online.

As the EU institutions pull down the shutters for the summer, we can only hope that politicians are able to reach a compromise that upholds democratic principles while keeping children safe and defending citizens' digital privacy.

The question of where data lives has become considerably more fraught over the past few years.

A mix of regulatory scrutiny, geopolitical tensions across the Atlantic, and the related unease about the concentration of infrastructure power among the hyperscalers have all combined to push data sovereignty up the executive agenda.

The result? A strategic posture that’s increasingly shaped by political anxiety rather than operational logic.

And while both need to be considered by the boardroom, leaning too much on the former leads to very different decisions.

To be clear, there’s no debate that compliance with data residency requirements remains a genuine obligation for organizations in regulated industries, and nobody is suggesting otherwise.

The concern is with what comes next: many organizations are at the "we must manage our data carefully" stage, and are considering a leap to "we should consider exiting hyperscaler infrastructure entirely." While the logic could be understandable, the reality is that full disengagement is neither effective nor necessary for the bulk of organizations.

The hyperscalers earned their position because they offered capabilities that were genuinely difficult to replicate at scale, and the organizations that depend on them most deeply are not in a position to unwind that dependency in any near-term timeframe. A multi-year transformation program with substantial execution risk is rarely the right answer to a political concern that may itself shift within that same period.

The focus on sovereignty has meant that ideas about data residency, infrastructure control, and operational resilience are being treated as interchangeable concepts. While connected, these are distinct ideas with distinct impacts on a business’s ability to function effectively and comply with regulation.

Let’s consider the incidents that really bring organizations down, and what makes data recovery harder than it needs to be. It’s system failures, slow incident response, and exploited security vulnerabilities that take customer-facing services offline, erode trust and incur regulatory fines. A platform that fails during peak demand causes the same commercial and reputational damage regardless of where its data is stored.

Similarly, a security breach does not become more or less severe based on whether it occurred on domestic or international infrastructure. The metrics that determine whether an organization functions under pressure are uptime, security posture and the quality of incident response capability. Sovereignty is one input to that picture, not the frame through which the whole picture should be viewed.

Simply put, an organization is not resilient simply because its data sits in the right jurisdiction. Resilience is an architectural and operational property that has to be built deliberately.

If sovereignty decisions are best understood as one component of broader operational resilience, then the more productive question is where in the stack is control most effectively exercised. The answer, particularly as AI applications proliferate, is primarily at the data layer.

The database has moved beyond its traditional role as a storage mechanism. In modern architectures, it is often the most reliable point of deterministic control in the entire stack: the place where governance is enforced in practice rather than documented in policy.

Data location, encryption, access controls, cross-region movement – all of these are data infrastructure questions at heart. Getting them right is what makes meaningful sovereignty achievable, not as a political statement, but as an operational capability.

So in turn, when an organization has genuine control over governance at the data layer, suddenly the choice between a hyperscaler and a fully domestic alternative becomes less relevant. The question shifts from which provider to use to whether the infrastructure is flexible enough to enforce the appropriate rules for each workload. That reframing tends to produce considerably better outcomes.

In practice, this means building in tiers: cloud-native performance where the business requires speed, scalability and flexibility, on-premise or segmented deployments for regulated workloads, and the architectural flexibility to move between configurations as circumstances change. After all, regulations will continue to evolve.

The geopolitical environment that is currently driving sovereignty conversations will look different in three years. That means infrastructure decisions made under today's conditions need to remain workable under tomorrow's.

The practical implication for technology leaders is straightforward: meet your regulatory obligations, exercise genuine control at the data layer, and build the architectural flexibility to adjust as requirements shift.

But after that, it’s important to give equal attention and consideration to the failure modes that are statistically far more likely to cause very tangible and costly problems: outages at peak load, delayed incident responses and vulnerabilities that could be exploited.

At the end of the day, those are far likelier to be discussed in post-mortems – not sovereignty. And while sovereignty deserves its place in the technology strategy conversation, it should sit within a resilience framework, not above it.

We've featured the best cloud databases.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

It's officially summer holiday season in the northern hemisphere (sorry, readers in Australia and New Zealand), and that means it's time to put the TV on for the kids before you go on family vacation.

You won't want to stick any of the following new movies or TV shows on for them, though. None of them are family friendly, so I'd advise you to load up something else on one of the world's best streaming services instead.

However, once they're tucked up in bed, I implore you to throw on one or more of these seven great-looking films and TV series. That said, maybe don't start this week's number one choice before you head off for a good night's rest yourself, because it is terrifying in the best way possible. — Tom Power, senior entertainment reporter

I'm not joking when I say Obsession, the breakout movie hit of 2026 so far that's finally landed on Peacock, is frighteningly fun. I spent weeks thinking about this supernatural horror after seeing it, and I'll readily admit that I felt uncomfortable for the first few nights post-watch, too.

For those who don't know: Obsession follows Bear (Michael Johnston), a lovesick loser who has a crushe on one of his besties Nikki (Inde Navarrette). When Bear stumbles upon an item called the One Wish Willow, he buys one and uses it to make Nikki fall in love with him. It's a spur-of-the-moment action that ends up having horrifying and deadly consequences, and will have you constantly repeating Nikki's "No, no, no, no, don't do thaaaaat!" line in your head as the plot progresses.

Before you stream it, check out our review of Obsession to see why everyone's, well, become obsessed with a film that, on a reported budget of just $750,000, has made $400m globally, broken horror film box office records, and turned Navarrette into a serial awards contender. And hey, if Peacock isn't available in your region yet, see where you can rent or but the Curry Barker-directed phenomenon instead. — TP

• Watch Obsession on Peacock

Guys... the end we've been dreading is here. Nick and Charlie's wholesome relationship has been an IP central to Netflix original content, but now it all ends with Heartstopper Forever.

If you're bummed out because we're not getting a full fourth season, don't be. As Nick, Charlie, and the gang all brace before going their separate ways to university, a feature film actually reflects their growing maturity and crises of confidence much more fittingly.

Heartstopper Forever really is forever... at least, it is in my house, where I'll be replaying it so much that Netflix might issue a warning. Its spirit and generation-defining impact will live on, and that might be the most special achievement the streamer has ever been responsible for. — Jasmine Valentine, entertainment reporter

• Watch Heartstopper Forever on Netflix

Whoever thought to cast Octavia Spencer and Hannah Waddingham together in an Amazon action comedy show needs a raise immediately. Ride or Die gives us the entertainment duo that we didn't know that we needed and plenty of laughs along the way.

The pair play best friends Debbie Claybourne and Judith Burton, who thought they knew everything about each other. But, when Judith (Waddingham) turns out to be an international assassin when a mysterious figure emerges, their worlds are turned upside down.

Tackling everything from menopause to, well, the complexities of life, this Prime Video Original is an incredible amount of fun. And, surely that's the most important thing in life, right? — JV

• Watch Ride or Die on Prime Video

Is there anything Anya Taylor-Joy can't do? Ever since she made her debut in Robert Eggers' The Witch, I've been impressed by just how varied each of her roles are.

In Apple TV's Lucky, she plays a con artist forced to go on the run after a heist goes wrong. Across seven episodes, we follow Luciana 'Lucky' Armstrong as she tries to evade the FBI and a ruthless crime boss, hoping that she'll live up to her nickname and make it out alive. It seems that breaking the law runs in her family, too, as Timothy Olyphant stars as her father who's in prison when the story begins.

The first two episodes are out now, and something tells me this will be another Apple Original for me to get hooked on. — Lucy Buglass, senior entertainment writer

• Watch Lucky on Apple TV

If you ask me, Will Ferrell and golf feels like a natural TV marriage. The Hawk on Netflix is proving me right, with Ferrell playing Lonnie Hawkins, a top golfer in 2004. Two decades on and he's trying to recapture his magic late in his career. However, he refuses to believe he's anything other than one stroke away from golf's greatest comeback.

If you've ever watched Happy Gilmore or The Phantom of the Open, this is for you... even if you're pretending that you actually know the first thing about the sport, which is easily done. — JV

• Watch The Hawk on Netflix

The Descendants franchise continues over on Disney+ with Wicked Wonderland, which marks the fifth installment in the series (even I didn't think that there had been so many).

Picking up shortly after Descendants: The Rise of Red, Red and Chloe return from their time-travelling adventures to find that the Queen of Hearts is trapped. The once notorious villain now has a nice streak, but that gives way to a new evil: Maddox Hatter.

Personally, I still can't believe that a UK 2010s popstar is playing one of the most iconic fictional queens of all time. If you're British, it has to be seen for that reason alone. — JV

• Watch Descendants: Wicked Wonderland on Disney+

Prime Video's new three-part docuseries is a fascinating one. Murder 101 is about a high school sociology class based in rural Tennessee who help revive a decades-old case into a shocking present-day hunt for a killer.

It's the sort of thing you'd expect to find in a work of fiction, Netflix's How to Get Away with Murder springs to mind, but this is 100% real. You can also check out the podcast of the same name if you'd like to dive in deeper.

Ultimately, this program showcases the power of a local community as we follow a group of students turned amateur sleuths. I'm already locked in. — LB

• Watch Murder 101 on Prime Video

• 1Password unveils Claude partnership, letting Anthropic’s AI authenticate on users’ behalf via zero‑exposure architecture
• Users approve each login with biometrics
• New Agentic Mode in the browser extension locks down the interface when AI agents take over

Top password manager company 1Password has launched a new tool that allows artificial intelligence assistant Claude to authenticate on behalf of their user, and thus complete assignments that were previously impossible without major security tradeoffs.

1Password for Claude is built on “zero-exposure architecture” - so in practice, it means Claude can essentially ask 1Password to complete the sign-in process, but it will never see the credentials, and they will never be loaded into its memory.

In turn, 1Password will notify the user, and will request biometric approval before proceeding. Once granted, it will autofill the credentials and check to see if they were exposed on the page or not. If submission fails, it will clear the filled values and report back.

"We need a new security model that is purpose-built for agents, not just humans,” said Nancy Wang, CTO of 1Password. “The answer isn't handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it. Claude knows it used your login; it does not need the password or one-time code in its context. That distinction is where trust in agents starts and the foundation we're building with Anthropic."

To further strengthen its security posture, 1Password also announced Agentic Mode, a new feature in the browser extension that gives users visibility and control over browser-based AI agents. When a compatible AI agent takes over, the 1Password extension automatically locks down and hides the interface. The agent can only use the logins and OTPs explicitly approved for the current task.

Even if the integration is not set up, and even if 1Password is not required for the current agentic task, Agentic Mode works, the company stressed. Other agents, besides Claude, are supported, as well.

Currently a major debate is ongoing, about how much permissions AI agents should receive, and under what rules. We’ve already seen horror stories of AI agents deleting people’s entire email inboxes, or otherwise ruining days of hard work. Whether or not this picks up or most people remain skeptical about giving AI access to certain services, remains to be seen.