Reports generated from the scanning of EU users’ private communications are analyzed using Palantir’s Foundry software at the National Center for Missing & Exploited Children (NCMEC), according to an investigation by Swedish newspaper Dagens ETC.
The findings raise questions about transparency and safeguards around sensitive data transferred to the United States, although NCMEC says Palantir itself cannot access the information.
Journalist Arvid Grange obtained confirmation from NCMEC vice president John Shehan that Foundry processes every CyberTipline report. Shehan said Palantir donated the software, which operates locally within NCMEC’s environment.
NCMEC is a US nonprofit whose CyberTipline receives reports of suspected child sexual exploitation and makes information available to law enforcement. US providers must report qualifying suspected offenses when they become aware of them. The organization received 21.3 million reports in 2025, with provider submissions containing 61.8 million images, videos, and other files.
The reporting pipeline connects European users to NCMEC through providers’ detection systems. Temporary EU rules permit companies to voluntarily detect and report child sexual abuse material (CSAM), creating an exemption from certain electronic communications privacy requirements. This permission to scan is separate from US obligations to report suspected offenses.
The original EU measure expired on April 3, 2026. Following a European Parliament vote to revive the scanning framework on July 9, the EU Council gave final approval to a replacement on July 23, and it applies until April 3, 2028, while negotiations continue over permanent legislation. The temporary rules exclude end-to-end encrypted communications.
Palantir says it began its partnership with NCMEC in 2010. Its software helps the organization connect information across reports and other data sources to support investigations into missing children and exploitation.
However, according to Grange’s report, the experts and lawmakers interviewed were unaware that Palantir tools were processing EU-origin reports. Shehan also said NCMEC could not determine precisely how many reports resulted from scanning in the EU because providers do not tell it how or where the reports were collected.
KU Leuven security researcher Bart Preneel warned that users have little visibility into how NCMEC handles their information after a provider reports it. The investigation also raised concerns about retention, citing policy language that does not specify a fixed storage limit. Bart Preneel was among more than 500 experts who warned that Chat Control threatened private communications in September 2025.
Data protection expert Laura Drechsler questioned whether transfers to NCMEC adequately protect Europeans’ fundamental rights. She pointed to reliance on alternative contractual arrangements rather than participation in the EU-US Data Privacy Framework. Her concerns do not constitute a regulatory or judicial finding that the transfers are unlawful.
The distinction between software use and data access remains central: the investigation establishes NCMEC’s use of Foundry, while NCMEC explicitly denies that Palantir can access the underlying data. It does not establish that every scanned message is sent to NCMEC or that Palantir performs providers’ initial scanning.
Dagens ETC said Palantir and the European Commission had not responded to its requests for comment.
Leave a Reply