Palantir Software Used to Analyze EU Chat Control Reports, Investigation Finds

10/19/2026 / By Douglas Harrington

Private messages sent by people in the European Union, scanned by technology companies under the bloc’s temporary “Chat Control” law, are analyzed using software built by U.S. data analytics firm Palantir, according to an investigation by Swedish journalist Arvid Grange published by the outlet Dagens ETC on Oct. 15.

The National Center for Missing & Exploited Children (NCMEC), the U.S. clearinghouse that receives the resulting tips, confirmed to Grange that it runs every report through Palantir’s Foundry platform, according to the investigation [1]. Reclaim The Net, which reported on the findings, stated that not a single lawmaker or expert interviewed for the report was aware that this was the case [1].

The reports at issue originate from Google, Microsoft, Snap and Meta, which scan images and videos inside users’ private messages and forward flagged material to NCMEC as required by U.S. law, the investigation stated [1]. NCMEC said Palantir’s software runs locally on its own servers and that Palantir has no access to the data [1].

Background: EU Scanning Law and NCMEC Reporting

The scanning arrangement traces back to a law first introduced as a temporary measure in 2021 and extended twice since, most recently in July to April 2028, according to the investigation [1]. The regulation does not specify which organizations companies may share the flagged data with, the investigation found, leaving the path from a European user’s message to a U.S. database largely undisclosed to the public [1].

The scale of the reporting pipeline is substantial. European Commission figures show that in 2024 just under one million NCMEC reports concerned the EU [1].

The temporary regulation, often called Chat Control, has drawn sustained opposition. Encrypted messaging app Signal has warned it would withdraw from Europe entirely rather than comply with a proposal forcing tech companies to break encryption, calling the plan “dangerous” and unworkable [2]. Reporting on the EU’s Child Sexual Abuse Regulation has described mandates for automated scanning of all private messages, emails and chats as government-backed mass surveillance framed as “voluntary” compliance [3].

Palantir’s Role and NCMEC Response

NCMEC states on its website that Palantir’s software “has revolutionized NCMEC’s database capabilities to help locate missing children” [1].

The organization’s privacy policy says it keeps personal information “for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations” [1]. An EU document mentions that Palantir’s software “supports” NCMEC but does not provide details, according to the investigation [1].

Palantir, a U.S.-based data analytics firm, has held contracts for intelligence and police work in several countries and has faced growing scrutiny in Europe over its data-handling practices [4]. The company’s reach extends beyond the NCMEC arrangement: Spain’s National Security Council added Palantir Technologies to a blacklist of companies prohibited from bidding on new government contracts, citing risks to domestic security and data sovereignty, according to officials familiar with the decision [4].

Accuracy and Legal Questions

The reliability of the automated detection systems feeding reports into this pipeline is disputed. The European Commission says the error rate for the most widely used technology is one false positive in 50 billion, but data security expert Bart Preneel and his team tested this and found the actual error rate was between one in every 1,000 and one in every 10 images, according to the investigation [1]. Preneel said the Commission’s claim was “a lie,” and that the likelihood of being reported was much higher for people sending “naked images of adults or sex messages” than for those sending “pictures of mountains or rivers or your car” [1].

Government data supports concerns about accuracy. Germany’s federal police said in 2024 that 48.3 percent of reports it received from NCMEC were not criminally relevant, the investigation found [1]. An EU implementation report showed that Yubo’s error rate was 20 percent in 2023 and 13 percent in 2024 [1]. In March, a study found Microsoft’s PhotoDNA to be “unreliable,” able to be tricked by adding a simple border to an image and to flag innocent users by altering harmless images [1].

The legal foundation of the process is also contested. Data law expert Laura Drechsler said it was difficult to argue that the whole process was legal, since NCMEC is not on the list of U.S. organizations allowed to receive personal data from the EU and instead uses a special contract, according to the investigation [1]. Drechsler and former MEP Patrick Breyer, a vocal critic of the EU law, both said they were unaware that Palantir was involved in the process [1]. The European Data Protection Supervisor confirmed that the European Commission violated EU privacy laws through its Chat Control proposal, after the EU ran targeted ads on X using micro-targeting that processed citizens’ sensitive political data without consent [5].

Political Reaction and Unresolved Questions

German MEP Lukas Sieper, who voted against the latest extension of the EU law, said he was not surprised that the data ended up being handled by Palantir, which he described as “George Orwell’s worst nightmare” [1]. Sieper also said that information about the involvement of the U.S. company was not made public during the debate on the law, adding that “It’s those juicy details that get lost in all the noise” [1].

The measure’s path through European institutions has been turbulent. The European Parliament voted against mass scanning by one vote in March, then revived the measure in July, according to the investigation [1]. On Sept. 29, EU countries met to discuss Chat Control 2.0 but did not reach an agreement on scanning private chats [1]. Critics reviewing the arrangement noted that NCMEC’s statement that Palantir’s software “runs locally” addresses who has access to the data, but not why it is there in the first place, or when it is deleted, the investigation stated [1].

Analysts who track data sovereignty issues have noted the broader pattern. Despite years of promises of digital sovereignty, the EU’s most sensitive systems increasingly rely on Palantir software, a dynamic described as the “Palantir paradox” [6].

References

EU Chat Control Reports Processed With Palantir Software. https://reclaimthenet.org/eu-chat-control-reports-palantir-software
Signal messaging app threatens exit from Europe amid Brussels war on encryption – NaturalNews.com, October 07, 2025.
EU’s “chat control” proposal: Mass surveillance disguised as child protection – NaturalNews.com, December 03, 2025.
Spain Blacklists Palantir Over Domestic Security Concerns. https://www.naturalnews.com/2026-07-05-spain-blackists-palantir-over-domestic-security-concerns.html
EMBARRASING EUs executive arm violates its own privacy laws – NaturalNews.com, December 20, 2024.
The Palantir paradox: Can European sovereignty be built on …. https://euperspectives.eu/2026/05/the-palantir-paradox-can-european-sovereignty-be-built-on-controversial-us-tech/