Personally, I don’t trust the “runs locally” comment or that this data isn’t uploaded to federal databases. And how do you know how they fingerprint and what data they’re looking to collect? I personally wouldn’t communicate intimately with any friends unless using end to end encryption with no AI agents present on both sides. But then everyone has their own privacy requirements.
https://reclaimthenet.org/eu-chat-control-reports-palantir-software
Palantir says little here, while the unanswered questions do plenty of talking.
By Ken Macon
Private messages of people in the EU, scanned by tech companies under the temporary “Chat Control” law, end up being analyzed with Palantir’s software, an investigation by Swedish journalist Arvid Grange has found.
The US law requires these companies to send the tips to the National Center for Missing & Exploited Children (NCMEC), and that organization has now confirmed that it runs every report through Palantir’s Foundry. Not a single one of the lawmakers and experts interviewed for the report was aware that this was the case.
The scanning of private communications in the EU was made possible by a law that was first introduced as temporary in 2021, and that has since been extended twice, most recently in July, to April 2028. The companies that are scanning for images and videos in people’s messages are Google, Microsoft, Snap, and Meta, but the EU law does not specify who these companies can share the data with.
It turns out that it ends up in a US database built on software made by Palantir, a company with roots in the CIA and a history of working with governments. NCMEC confirmed that it uses Palantir’s Foundry, but said that the software runs locally on its own servers, and that Palantir has no access to the data.
The investigation was first published by the Swedish outlet Dagens ETC on October 13.
The data in question is reports sent by companies to NCMEC, that contain images, videos, and other files that are flagged by the companies’ automated systems. In 2025, NCMEC said, these reports “contained 61.8 million images, videos and other files.”
NCMEC vice president John Shehan is quoted as saying that the organization’s biggest fear had been that something was “slipping through the cracks,” and that Palantir was brought in to deal with “big data.”
NCMEC itself says on its website that Palantir’s software “has revolutionized NCMEC’s database capabilities to help locate missing children.”
The privacy policy of the organization reveals that it keeps personal information “for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.”
It is unclear how many of the reports that end up with NCMEC come from the EU, as the companies are not required to disclose that information. However, figures from the European Commission show that in 2024, just under one million NCMEC reports concerned the EU.
The Commission also says that the error rate for the most widely used technology is one false positive in 50 billion. But data security expert Bart Preneel and his team tested this and found that the actual error rate was between one in every 1,000 and one in every 10 images.
Preneel said that the Commission’s claim was “a lie,” and that the likelihood of being reported was much higher if people were sending each other “naked images of adults or sex messages,” than if they were sending “pictures of mountains or rivers or your car.”
Preneel is also concerned that the data is handled by Palantir, which he said is “an organization doing intelligence collection, that works closely with several governments, including the USA.”
“If you are reported by Meta to NCMEC, then your data will be processed by the NCMEC ecosystem which includes Palantir, and we don’t know the details of this,” Preneel said.
German MEP Lukas Sieper, who voted against the latest extension of the EU law, said he was not surprised that the data ended up being handled by Palantir, which he described as “George Orwell’s worst nightmare.”
Sieper also noted that the information about the involvement of the US company was not made public during the debate on the law. “It’s those juicy details that get lost in all the noise,” he said.
An EU document mentions that Palantir’s software “supports” NCMEC, but does not go into any details. Data law expert Laura Drechsler said that it was difficult to argue that the whole process was legal, since NCMEC is not on the list of US organizations that are allowed to receive personal data from the EU, and instead uses a special contract that is supposed to guarantee a high level of protection of fundamental rights.
Drechsler and former MEP Patrick Breyer, who is a vocal critic of the EU law, were also unaware that Palantir was involved in the process.
Meanwhile, the accuracy of the automated systems used by the companies has been disputed. In 2024, Germany’s federal police (BKA) said that 48.3 percent of reports it received from NCMEC were not criminally relevant. An EU implementation report showed that the error rate for Yubo was 20 percent in 2023, and 13 percent in 2024.
In March, a study found Microsoft’s PhotoDNA to be “unreliable.” The tool can be tricked by adding a simple border to an image, and can flag innocent users by altering harmless images. Moreover, the study found that this can be done in under ten minutes on a laptop.
The same month, the European Parliament voted against mass scanning by just one vote, only to bring it back to life in July. On September 29, EU countries met to discuss Chat Control 2.0, but did not reach an agreement on scanning private chats.
The investigation into how the system works shows that a European’s private photo, flagged by a machine that is often wrong, ends up in a US database built on Palantir software, and is kept there for as long as NCMEC decides.
Shehan’s claim that Palantir’s software “runs locally” addresses the question of who has access to the data – but not why it is there in the first place, or when it is deleted.