The recurring argument on this site about Chat Control has been that the permanent regulation is the fight everyone watches while the temporary regime — the derogation that has let platforms scan private messages since 2021 — does the quiet work. The Council put excluding private messages on the table and the negotiations stalled on September 29 with the vote moved to November. That is the permanent law. The temporary one does not wait for any of it: Parliament extended it on July 9 to April 3, 2028, over its own chamber's March rejection.

So the question that matters is not only "what might they mandate next" but "what happens today, to your private messages, under the law already in force." A Swedish investigation published this week in Dagens ETC — republished in English by the reporter, Arvid Grange — followed that pipeline to its end, and the end is Palantir.

The pipeline as it runs right now

The chain has five links, and each one is documented:

  1. Scanning. Google, Microsoft, Meta and Snap scan EU users' private messages for images and videos under the temporary derogation. Google states this itself. Services that ship E2EE by default — WhatsApp, Messenger, Signal, per the investigation — are exempt in practice, because there is nothing the provider can read. Instagram DMs are not exempt.
  2. The US reporting obligation. US law 18 U.S.C. § 2258A requires providers to report apparent child sexual abuse material to NCMEC — including material collected in the EU. The EU law does not say who the providers may share the data with; the US law answers for them.
  3. NCMEC. The National Center for Missing & Exploited Children is a US nonprofit. It is not listed under the EU–US Data Privacy Framework — the register of US organisations deemed reliable for personal-data transfers. It relies on "alternative routes" through contracts instead. EU data-law expert Laura Drechsler's assessment: "It is difficult to argue fully that it is legal."
  4. Palantir Foundry. Asked directly, NCMEC confirmed to Dagens ETC: "We utilize the Palantir Foundry for all CyberTipline reports" — John Shehan, VP. Palantir donated the software and engineering support; per NCMEC it runs locally in NCMEC's own environment and Palantir itself has no access to the data. NCMEC's public pages and Palantir's own say the same thing. This was already known to be a deep collaboration — it just had not been connected to the Chat Control scanning that EU citizens' messages undergo.
  5. Retention. NCMEC's privacy policy keeps the material "as long as necessary" and "for legitimate business purposes." No stated limit.

The volumes, per the investigation: just under one million of NCMEC's reports concerned the EU in 2024, per the European Commission's own implementation report. LinkedIn — the only company that has reported back its EU-specific counts — processed 22 million images and more than 2 million videos from EU users that year. Microsoft told the Commission it scanned 9.6 billion images and videos globally in 2024. NCMEC's CyberTipline received 21 million reports in 2025. In 2020 — on video from Palantir's own account — NCMEC named 25 analysts handling the flow. The gap between twenty-one million reports and twenty-five humans is the answer to why a vendor's platform sits inside a child-safety nonprofit at all.

What nobody in the room knew

The uncomfortable part of the story is not the link itself — NCMEC–Palantir is public, on both organisations' websites. It is who was unaware of it while deciding on the law:

  • Lukas Sieper, German MEP, voted against the July extension. He did not know Palantir's software was in the chain. His response on learning it: "I would not be surprised," and then: "Palantir is George Orwell's worst nightmare."
  • Bart Preneel (KU Leuven) was invited into the European Commission's own expert group in 2021 to work out how scanning could cover E2EE messages. He did not know either: "If you are reported by Meta to NCMEC, then your data will be processed by the NCMEC ecosystem which includes Palantir, and we don't know the details of this."
  • Patrick Breyer, the former MEP who spent years opposing the proposal, did not know. Neither did Drechsler.

And it was written down. A 2023 European Parliament Research Service briefing states that Palantir's software "supports" NCMEC. Not secret — procedurally published. One PDF link away from every legislator who debated the extension, in a document nobody circulated while tens of millions of advocacy pamphlets were. Sieper's theory of why: "They provide you with tons and tons of information... It's those juicy details that get lost in all the noise."

For the November vote this is relevant in one specific way: the arguments for making scanning permanent are accuracy and control. The current regime demonstrates what happens in practice — the scanned material leaves the EU for an organisation absent from the EU's own adequacy list, gets processed through a platform owned by a company that contracts with the Trump administration's immigration apparatus, and retains it indefinitely, under a regime whose own operators said no one tracks how the reports break down by origin. Nobody voted on that, because nobody outside the chain knew to ask.

The false-positive math is not a rounding dispute

The European Commission has claimed that the most widely used scanning technology produces as few as one false positive in fifty billion images. Preneel's team tested it on a database of celebrity faces — the USENIX Security 2026 paper reports false matches between one in a thousand and one in ten.

"One in fifty billion is a lie," Preneel told Dagens ETC.

The pattern is worse than a rate. Photos of faces are the highest-risk class, which means the material most likely to be flagged and reported into NCMEC's system — a system with indefinite retention, outside EU jurisdiction — is intimate imagery: consensual adult nudes, sexual conversations, family photos of children at bath time. "If you send naked images of adults or sex messages, then you are much more likely to be reported than if you send pictures of mountains or rivers or your car." Every false positive is not a rejected filter entry; it is a report filed with a US nonprofit, cross-linked into a data-mining platform, kept for as long as the nonprofit deems necessary. Multiply a false-match rate of one-in-a-thousand by a provider scanning billions of images a year and sit with the resulting number of wrong reports.

What this means for communities running their own infrastructure

The pipeline binds platforms. If your community's conversations run on surfaces the providers scan — the investigation's lists include Instagram and TikTok DMs, Discord, Snapchat, Skype, Xbox chat, and email via Gmail — the images and videos passing through them are in scope of this machinery. The exemption class is E2EE-by-default design; the exemption is the architecture, not a policy toggle — that is the same finding we keep arriving at: the only defense that does not depend on the next vote's wording is messages that never sit on a server that scans them.

For a community, that cuts two ways:

  • The platform your people choose personally matters. A member's WhatsApp is exempt from the scanning pipeline; their Instagram DM is in it. Worth saying out loud in community security settings, because the difference is invisible in the app switcher.
  • The platform a community runs matters more, because it can be chosen once. A Matrix homeserver with E2EE produces messages that never pass through a provider's scanner at all. Nothing in the current regime reaches it — and the permanent regulation aimed at operators is exactly the November fight. If that passes in any form that obliges operators to scan, self-hosting stops being a preference and becomes the shield it has always quietly been.

There is also a jurisdiction lesson here that goes beyond chat. The US designation that killed a 25-year-old collective host in eleven days and this pipeline are the same species: a US legal instrument reaching into European citizens' communications infrastructure, without any European process watching the data flow. The response is the same in both cases, too — hosting on infrastructure whose jurisdiction you can actually influence.

The honest caveats

This is one investigation's reporting — but its load-bearing claims have primary anchors. The NCMEC confirmation is NCMEC's own written statement. The Palantir relationship is on Palantir's own page and in a Congressional testimony. The EU figures come from the Commission's report. The false-positive work is a published USENIX preprint. Read the English republication rather than this summary.

NCMEC's claim that Palantir has no access to the data is NCMEC's own accounting. No third-party audit of the Foundry deployment is cited anywhere in the chain. Palantir donated the platform, which is a structural fact worth holding alongside the reassurance: nothing about the arrangement is at arm's length, least of all the software.

The child-protection mission is real and the report volumes are real. The critique here is not about whether child sexual abuse is a crime that must be pursued — it is about jurisdiction, accuracy, retention, and the fact that a data flow this large ran for half a decade inside a blind spot that its own legislators and its own invited experts could not see into. Those are the dimensions a permanent law would be judged on, and the current regime is its own worst evidence.

Palantir and the European Commission declined to comment to Dagens ETC.

Sources: Dagens ETC / Arvid Grange investigation, Oct 13, 2026 (original: Så granskar Meta dina privata chattar med hjälp av Palantir); 18 U.S.C. § 2258A; Commission implementation report SWD(2025) 740; Leblanc, Albarel, Preneel et al., USENIX Security 2026 prepub; EPRS briefing 753179 (2023); Palantir–NCMEC; NCMEC testimony to House Oversight, Dec 2025; EU–US Data Privacy Framework list; Patrick Breyer's amplification, Oct 14, 2026.