Investigation: EU citizens' private messages are run through Palantir's software

Arvid Grange

okt 13, 2026

14

5

Dela

Palantir’s logo and a session in the European Parliament. Photo: Unsplash & © European Union.

This investigation was originally published by Dagens ETC, here.

Recently, negotiations stalled in the EU over the permanent framework for the contested “Chat Control” law. While lawmakers and ministers keep disagreeing over the final version of the law, a temporary iteration of it has allowed tech companies to scan the contents of EU citizens private messages since 2021, which they continue to do.

Tack för att du läser Arvid:s Substack! Prenumerera gratis för att få nya inlägg och stötta mitt arbete.

The temporary law expired this spring but an extension was agreed on in July. Now companies such as Google, Microsoft, Snap and Meta are actively scanning EU citizens private messages for images and videos, with the aim of finding and combating child sexual abuse.

Supporters believe the law is needed to protect children and bring perpetrators to justice. But far from everyone thinks the end justifies the means. Critics of the law, who have dubbed it “Chat Control”, claim it is establishing a system of mass surveillance in Europe.

While the EU law does not state which third party companies or organisations the tech companies may share the data with, U.S. law requires them to send suspected tips, even those collected in the EU, to the American organisation National Center for Missing & Exploited Children, NCMEC.

NCMEC, in turn, works closely with Palantir.

Apart from LinkedIn, no company covered by the law has reported back to the EU how many messages it scans specifically from European users. They alone processed 22 million images and more than 2 million videos from EU users in 2024. Microsoft reported that they scanned 9.6 billion images and videos globally in 2024.

With the tech companies’ scanning, NCMEC’s CyberTipline received 21 million reports of potential child sexual abuse in 2025. Such large volumes of data are demanding to analyse, the organisation’s vice president John Shehan says in a YouTube-video from 2020. Especially when the organisation only has 25 analysts.

“Our biggest fear was that something was slipping through the cracks. That there was information being reported into our systems that we weren’t identifying, that could have helped lead to the rescue of that child,” John Shehan says in the video. “ And we knew that Palantir could deal with big data.”

The video, uploaded to Palantir’s own account, describes a deep collaboration between the two organisations, in which Palantir’s algorithm automatically finds connections in NCMEC’s database.

Palantir is a highly controversial company that was founded after 11 September 2001 with the CIA as an early investor, and is now hired by the Trump administration to streamline the deportations carried out by the United States immigration police, ICE. According to a UN report, the company is also believed to provide the Israeli military with an AI platform for automated decision-making on the battlefield.

Although the link between Palantir and NCMEC is not secret, media has previously not reported on Palantir’s connection to the mass scanning of messages under “Chat Control”. And none of those interviewed in this investigation – neither EU legislators nor experts – knew of the collaboration.

One of them is data security expert Bart Preneel. Before the temporary law came into existence in 2021, he was one of the experts invited by the European Commission to a consultant group with representatives from intelligence agencies as well as industries, to work out how the final version of the law could scan end-to-end encrypted messages.

“It is definitely a concern. Palantir is an organization doing intelligence collection, that works closely with several governments, including the USA,” says Bart Preneel.

Bart Preneel. Photo: Press/KU Leuven

The lack of transparency into what happens to the private images of EU citizens after they end up in Palantir’s program, is an issue, says Bart Preneel.

“If you are reported by Meta to NCMEC, then your data will be processed by the NCMEC ecosystem which includes Palantir, and we don’t know the details of this.”

NCMEC does not state any limit to how long they store the material. According to its privacy policy, it retains the data “as long as necessary” and “for legitimate business purposes”.

On its website, NCMEC writes that Palantir’s software helps them find connections across different data sources.

They say Palantir’s tools are essential for locating and rescuing children and that the AI-company helps NCMEC catalogue and search the large volume of data in its systems. Palantir has donated hardware and provided engineering resources, and according to NCMEC, Palantir’s software Foundry has revolutionised their database. Palantir also confirms this.

In a testimony to the US Congress last year, the head of NCMEC’s program against child sex trafficking describes how they used Foundry to find a missing girl and the man who forced her to sell sex.

After being asked directly, NCMEC confirms to Dagens ETC that the data scanned in the EU is analysed using Palantir’s tools.

“We utilize the Palantir Foundry for all CyberTipline reports,” the organisation’s vice president John Shehan writes in a response to Dagens ETC.

He adds that Palantir donated the software, that it runs locally in NCMEC’s environment, and that Palantir itself does not have access to the data. NCMEC does not know exactly how many of its reports come from scanning carried out specifically in the EU, John Shehan writes. The tech companies do not inform NCMEC of how or where they collect the reports.

Figures from the European Commission show that just under one million of NCMEC’s reports concerned the EU in 2024. Lukas Sieper is a German MEP who voted this summer against extending the legislation that allows mass scanning in the EU. He says he does not know which software is used.

If I told you that it’s Palantir’s software that is used?

But he is not pleased to hear that it is the case.

“Palantir is George Orwell’s worst nightmare, and it is politically very deeply connected to the Trump administration,” says Lukas Sieper.

The reason why he was not aware of the connection, he believes, is that lobbyists flood parliamentarians with other information.

EU Parliamentarian Lukas Sieper from the German Party of Progress. Photo: © European Union

“They provide you with tons and tons of information. They send you all these pamphlets to your letterbox and stuff,” he says.

No pamphlets or debates have mentioned that Palantir’s software is used by the organisation, he adds.

Some of the information has, however, reached at least parts of the European Parliament. An EU document on which organisations have interests tied to the law states that Palantir’s software “supports” NCMEC in its work.

Had that information been more widely circulated, Lukas Sieper believes more of his colleagues would have voted against the law this summer.

“It’s those juicy details that get lost in all the noise,” says Lukas Sieper.

According to the European Commission, the technology used for scanning private messages is highly accurate, so that ordinary messages are not registered as abuse material and sent to NCMEC. The EU has claimed that the most widely used technology has as few false positives as one in 50 billion.

But in a test database of photos of celebrities’ faces, data security expert Bart Preneel’s research team got a false match in as many as between one in every thousand and one in every ten images.

His research shows that images of faces are at particularly high risk of being flagged as potential abuse material. This leads Bart Preneel to suspect that images of children too – even if the children are one’s own – and consensually shared nude images are more likely to be registered as potential abuse material and sent to NCMEC.

“If you send naked images of adults or sex messages, then you are much more likely to be reported than if you send pictures of mountains or rivers or your car.”

Another person who was unaware of this connection is one of the most active critics of the law, former MEP Patrick Breyer of the German Pirate Party. The same goes for data protection lawyer and expert on European data law Laura Drechsler. She questions whether the transfer of EU citizens’ personal data from the tech giants to NCMEC is legal at all.

“It is difficult to argue fully that it is legal,” she says.

Laura Drechsler, data law expert. Photo: Press/KU Leuven.

The EU has a register of U.S. organisations that are deemed reliable for transfers of personal data. NCMEC is not on the list of approved organisations. Instead there are alternative routes, through special contracts, which they use.

But that increases the risk that the EU’s data protection requirements are not met, Laura Drechsler says.

“Then they themselves have to maintain an appropriate level of fundamental rights protection,” she says.

Today, end-to-end encrypted messaging services such as WhatsApp, Messenger and Signal are exempt from the scanning. This has been a major cause of disagreement between the negotiating parties within the EU.

Messages on Instagram, for example, are not exempt.

Dagens ETC has contacted Palantir and the European Commission and asked for comments, but has not received a response.

Palantir writes on its website that, contrary to some media reporting, it is not a “surveillance company”. It develops and licenses software that allows its customers to analyse their own data, it writes.

Tack för att du läser Arvid:s Substack! Prenumerera gratis för att få nya inlägg och stötta mitt arbete.