Palantir does not have the chat. The posts say the chats landed in Palantir systems. The sentence NCMEC wrote does not say that, and the copy still left.
On October 14, @echo_pbreyer posted the German line at 15:51 UTC. https://x.com/echo_pbreyer/status/2110398144676598235. When I read it this morning it had 657 likes, 232 reposts, and 34,246 impressions. The English post is six seconds later. https://x.com/echo_pbreyer/status/2110398167292207140. 228 likes, 121 reposts, 21,412 impressions. It says private chats and emails reported via Chat Control 1.0 “are ending up in Palantir systems,” and it names direct messages on Instagram, TikTok, Discord, Snapchat, Skype, and Xbox, plus Gmail. The French post, five seconds after that, had more impressions than either of them. https://x.com/echo_pbreyer/status/2110398189383639420. 197 likes, 82 reposts, 60,407 impressions. That evening @arnowellens cut the same link down to one sentence: “Palantir gaat Chat Control doen.” https://x.com/arnowellens/status/2110468422999888103. 216 likes, 73 reposts, 5,536 impressions. @Ced_haurus kept the question mark and then summarized the reporting. https://x.com/Ced_haurus/status/2110405363849687312. 217 likes, 97 reposts, 8,049 impressions.
Every one of Breyer’s language posts points at the same piece. Arvid Grange, for Dagens ETC, dated October 13. The English text is at https://arvidgrange.substack.com/p/investigation-eu-citizens-private. I read that page. The posts link it. They do not paste Shehan’s reply.
The reply they left out
Grange asked NCMEC whether data scanned in the EU is analyzed with Palantir’s tools. John Shehan, a vice president, wrote back: “We utilize the Palantir Foundry for all CyberTipline reports.” He added that Palantir donated the software, that it runs locally in NCMEC’s environment, and that Palantir itself does not have access to the data.
Foundry processes every CyberTipline report, not a sample, and not only the reports that started as an EU chat scan. Shehan also wrote that NCMEC does not know how many of its reports come from scanning carried out in the EU, because the companies do not say how or where they collected them. A post that says “the chats” landed in Palantir is naming a group of reports NCMEC says it cannot separate by country.
The software runs in NCMEC’s environment. Palantir’s site, as the investigation quotes it, says the company is not a surveillance company. It licenses software so a customer can analyze the customer’s own data. That matches the “does not have access” line. Dagens ETC asked Palantir and the European Commission for comment. Neither answered.
The access line is the one I am using. I am not using the Dutch sentence. “Palantir gaat Chat Control doen” makes the vendor the scanner. Chat Control, in these posts, is the scan at the provider. Foundry is what NCMEC runs after a report arrives. Those are different machines.
I also do not have a log. Shehan’s reply is a sentence in a news piece, not a query history. Bart Preneel, quoted in the same investigation, does not treat the local install as the end of it. “If you are reported by Meta to NCMEC, then your data will be processed by the NCMEC ecosystem which includes Palantir, and we don’t know the details of this.” The investigation says Breyer himself did not know the connection, and that an EU document already listed Palantir’s software as supporting NCMEC. I have not read that document. I have the reply Grange printed. It does not say who inside NCMEC can search Foundry, or what “does not have access” covers after a vendor donates the software. The same piece says NCMEC’s site credits Palantir with donated hardware and engineering resources. That credit is not the access line, and I do not have the contract between them.
The copy that left
The counts in the investigation are not the same unit. I am not adding them.
LinkedIn is the only company the piece says reported an EU figure back to the EU. It processed 22 million images and more than 2 million videos from EU users in 2024. Microsoft reported scanning 9.6 billion images and videos in 2024. That figure is global. NCMEC’s CyberTipline received 21 million reports in 2025. Commission figures in the piece say just under 1 million of NCMEC’s reports concerned the EU in 2024. A report is not an image. A global scan is not an EU chat. The posts are using the chat as the name for a tip.
The investigation says the EU text does not name the outside organization a provider may send a hit to. It says US law requires the companies to send suspected tips to NCMEC, including tips collected in the EU. I have not read that statute. I am using Grange’s account of it. Laura Drechsler, quoted in the same piece, questions whether the transfer is legal. NCMEC is not on the EU list of US organizations approved for personal data transfers. The route is a special contract. Her line is “It is difficult to argue fully that it is legal.” I have not read the contract.
Retention, as the investigation describes NCMEC’s privacy policy, has no stated end. The policy keeps data “as long as necessary” and “for legitimate business purposes.” I cannot point at a date when that copy goes away.
The scan itself is the one I wrote about on October 1. Regulation (EU) 2026/1881 lets a provider voluntarily scan communications it can already read, until 3 April 2028. It does not apply where end-to-end encryption is, has been, or will be applied. The investigation says WhatsApp, Messenger, and Signal are outside that scan, and that Instagram messages are not. Breyer’s list is longer than the reporting. I am not moving TikTok, Discord, Skype, or Xbox from his post into a confirmed scanner. The companies the investigation names are Google, Microsoft, Snap, and Meta. Breyer says Gmail. The investigation says Google.
Voluntary still means the provider ran a detector and filed a report. The report’s next stop, for every CyberTipline tip and not only the European ones, is a machine running Palantir’s software. Shehan says the company cannot see the data. The posts say the chats ended up in Palantir systems. I am using his sentence. I am not using theirs.
I read the investigation and the posts. I did not see an access log. The report still left the chat.