Private images and messages flagged under the European Union's temporary "Chat Control" scanning rules are being processed using software built by Palantir, the US data-analytics firm with deep roots in intelligence work. The finding comes from an investigation by Swedish journalist Arvid Grange, first published by the outlet Dagens ETC, and it caught even specialist lawmakers and privacy researchers off guard.
How a scan in Europe ends up in a US system
The mechanism works like this: companies including Google, Microsoft, Snap, and Meta are required, under an EU law first adopted as a temporary measure in 2021 and extended twice since - most recently to April 2028 - to scan private communications for suspected child sexual abuse material. When their automated systems flag something, the companies forward it to the US-based National Center for Missing & Exploited Children, or NCMEC, as required under American law. The EU regulation itself says nothing about what happens to the data once it leaves European hands.
NCMEC has now confirmed that every one of these reports is run through Palantir's Foundry platform. In 2025 alone, the organization said, it processed reports containing 61.8 million images, videos, and other files. NCMEC vice president John Shehan said the software was brought in to manage this volume of "big data" and to prevent cases from "slipping through the cracks." He added that Foundry runs on NCMEC's own servers and that Palantir itself does not access the data - a distinction that addresses who can see the material, but not why it is routed through a foreign intelligence contractor's architecture in the first place, or how long it is retained. NCMEC's own privacy policy states only that information is kept "for as long as necessary" to meet its operational and legal obligations.
A margin of error far wider than advertised
The European Commission has defended the scanning regime by citing an error rate of one false positive in 50 billion for the most widely used detection technology. Independent testing by data security expert Bart Preneel and his team produced a starkly different figure: an error rate between one in 1,000 and one in 10 images. Preneel called the Commission's claim "a lie" and noted that ordinary, legal content - intimate images between adults, for instance - is far more likely to trigger a false flag than an innocuous photo of a landscape.
Real-world enforcement data points the same way. Germany's federal police reported that 48.3 percent of NCMEC tips it received in 2024 were not criminally relevant. EU implementation figures showed error rates of 20 percent in 2023 and 13 percent in 2024 for the platform Yubo. Separate research published in March found that Microsoft's PhotoDNA tool could be defeated by adding a simple border to an image, or tricked into flagging harmless pictures - manipulations achievable on an ordinary laptop in under ten minutes.
Legal uncertainty and a transparency gap
Data law expert Laura Drechsler said the legality of the entire arrangement is questionable, since NCMEC does not appear on the list of US organizations approved to receive personal data from the EU under standard adequacy frameworks. Instead, the transfers rely on a special contractual mechanism meant to guarantee strong rights protections - one whose practical safeguards remain largely undocumented in public EU materials, which mention only that Palantir's software "supports" NCMEC.
Neither Drechsler nor former MEP Patrick Breyer, a longtime critic of the scanning law, knew of Palantir's role before the investigation. German MEP Lukas Sieper, who voted against the law's latest extension, said he was unsurprised, describing Palantir as "George Orwell's worst nightmare," and argued that such details are routinely lost in legislative debate. EU governments met on September 29 to discuss a revised version of the scanning rules, known as Chat Control 2.0, but failed to reach agreement - leaving the underlying question unresolved: how much error, and how much foreign data handling, Europeans should accept in the name of child protection.
