A Substack investigation, relayed through a Reddit post in a Swedish forum and an aggregation on Bytes Europe, claims that private messages scanned under the EU's Chat Control 1.0 regime are being forwarded to Palantir for analysis. The claim has spread quickly, but the material available to us is thin. Here is what the reports say, what the scanning actually covers, and what it means for everyday users. The topic of Chat Control 1.0 Palantir scanning deserves careful reading before anyone draws conclusions.

What the Palantir claim actually says

The headline reads: "EU citizens' private messages are scanned by Chat Control 1.0 and forwarded for analysis to Palantir." The Bytes Europe item is an aggregation. It consists of a link to the Substack investigation and the title of the Reddit post (originally in Swedish) that shared it. It does not reproduce the investigation's evidence, documents, or methodology.

That matters. We have not independently verified the claim, and the summary we reviewed contains no named sources, technical details, or responses from Palantir, the European Commission, or the companies doing the scanning. Until the underlying investigation is examined and the parties involved respond, the claim should be treated as an allegation, not an established fact.

What can be said is narrower: a published investigation makes this assertion, and it is circulating widely enough to prompt questions about where scanned data goes after it leaves a user's device or a platform's servers.

How Chat Control 1.0 scans private messages

Chat Control 1.0 refers to the EU's interim, voluntary framework that allows certain communication providers to scan content for child sexual abuse material. Commentary in the search results covering this topic stresses a key distinction: it is voluntary, and it has not reached end-to-end encrypted messaging. In other words, providers may choose to scan, and the scanning applies to services where they can technically access message content.

This differs from the more sweeping proposals often grouped under "Chat Control 2.0," which critics argue would pressure services to scan content even on encrypted platforms. The legal status of these measures has shifted repeatedly. For the latest on where the legislation stands, see our explainer on the European Parliament's chat monitoring vote.

It is worth being precise about what scanning means here. Providers typically use automated tools to detect known material or flag suspicious content, and flagged items can then be reported onward. The Palantir claim is not about the existence of this scanning, which is documented policy. It is about a further step: whether message data or related material is passed to a third-party analytics company.

Why routing message data to an analytics firm raises trust concerns

Even if the claim proves partly or wholly inaccurate, it points to a legitimate question: who handles scanned data once it is flagged? Voluntary scanning schemes involve several parties, including platforms, reporting bodies, and law enforcement. Each additional processor widens the circle of people and systems with access to sensitive content.

Palantir is a data analytics company known for working with governments and large organizations. Its involvement, if confirmed, would raise questions that apply to any analytics vendor:

  • What legal basis allows message data to be shared with a contractor?
  • Is the data retained, and for how long?
  • Can it be combined with other datasets?
  • Who audits the process, and can affected users find out?

These are transparency and accountability questions, not proof of wrongdoing. Critics of the scanning regime have long argued that the safeguards around reporting and data handling are hard for the public to inspect. An unverified allegation like this one thrives in exactly that gap. Clear answers from the Commission, the providers involved, and Palantir itself would settle much of the uncertainty.

What This Means For You

For most people, nothing about the immediate situation has changed: the scanning described under Chat Control 1.0 is voluntary and depends on which services you use and how they are configured. The Palantir allegation, as presented, does not show that your messages have been sent to a third party.

What the story does highlight is that the privacy of your messages depends heavily on the app you choose. If a service can read your messages on its servers, it can scan them, and that content can potentially be shared onward under whatever policies apply. If a service uses end-to-end encryption by default, the provider cannot read the content in the first place, which is why the encryption question sits at the center of the wider debate.

What you can do: encryption, legal status and the limits of VPNs

A note on VPNs, since readers often ask: a VPN encrypts traffic between your device and the VPN server and hides your IP address from sites you visit. It does not change what your messaging provider can see once your message reaches it. If the app scans unencrypted message content on its servers, a VPN will not prevent that. Message-level protection comes from end-to-end encryption, not from a network tunnel.

Practical steps:

  • Check which apps you use. Find out whether each messaging service offers end-to-end encryption, and whether it is on by default or must be enabled per chat.
  • Read the privacy policy. Look for language about scanning, content moderation, and sharing data with third-party processors.
  • Be cautious with unverified claims. Look for the original investigation, named sources, and responses from the companies involved before sharing.
  • Follow the legal status. The rules around voluntary scanning have changed several times, so keep an eye on official developments.

The bottom line

The Chat Control 1.0 Palantir scanning claim is serious if true, but the material circulating so far is a relay of an investigation, not confirmation. Treat it as an open question, not a settled fact. In the meantime, review the messaging apps you rely on, favor those with end-to-end encryption, and follow the latest developments in our guide to the EU chat monitoring vote to understand where the law stands today.