Palantir's Defense Work Raises Privacy Concerns as CEO Acknowledges 10% of World 'Professionally Hates Us'

Palantir's recent financial success, driven by increased government spending during the Iran War, has reignited concerns about the data-mining giant's privacy practices. CEO Alex Karp's admission that "nine tenths of the world loves us, one tenth of the world professionally hates us" reflects the deep divide surrounding the company's controversial data collection and analysis methods.

The Department of Defense's doubled usage of Palantir's Maven targeting system in just four months has raised significant privacy and ethical questions. Maven, designed to identify targets using artificial intelligence and data analysis, processes vast amounts of information, potentially including personal data of individuals in conflict zones. Under regulations like the EU's General Data Protection Regulation (GDPR) and California's Consumer Privacy Act (CCPA), such data collection requires stringent safeguards and transparency that critics argue Palantir fails to provide.

Palantir's work with governments accused of war crimes compounds these concerns. When defense contractors and government agencies use Palantir's platforms to track individuals, determine targets, or monitor populations, they may be processing personal data without adequate consent or legal basis. This places Palantir in a precarious position regarding data protection regulations, which require lawful bases for processing personal data, including explicit consent in many cases.

The company's $484 million deal with the US Navy and Maritime Industrial Base, while touted for efficiency improvements, involves the processing of sensitive supply chain and potentially personal data. The claimed reduction in bill of material approval time from 200 hours to 15 seconds suggests an unprecedented level of data integration and analysis, which inherently increases privacy risks.

Privacy advocates point to Palantir's business model as inherently problematic. The company specializes in connecting disparate data sources to find patterns and insights, a process that often involves merging personal information from various sources without individuals' knowledge or consent. This practice conflicts with the fundamental privacy principles enshrined in GDPR, which emphasizes data minimization and purpose limitation.

Regulatory enforcement against Palantir has been inconsistent despite numerous documented privacy concerns. In 2023, the UK's Information Commissioner's Office (ICO) launched an investigation into Palantir's data processing practices for the NHS, though the outcome remains pending. Similarly, privacy advocates have called for scrutiny under CCPA, particularly regarding Palantir's work with commercial clients in sectors like healthcare and finance, where sensitive personal data is routinely processed.

The potential penalties for non-compliance with these regulations are substantial. GDPR allows fines of up to €20 million or 4% of global annual turnover, whichever is higher. For a company with Palantir's revenue growth—reaching $1.63 billion in the first quarter of 2026, up 85% year-over-year—such penalties could amount to hundreds of millions of dollars.

Palantir's CEO has defended the company's practices by prioritizing "US national security" above all else, including commercial client relationships. This stance creates tension with privacy regulations that do not recognize national security as an automatic exemption from data protection requirements. Under GDPR, for instance, national security interests may override certain data protection principles, but only through specific legal frameworks that include safeguards and oversight mechanisms.

The impact on individuals whose data is processed by Palantir's systems is profound and often invisible. When defense agencies use Maven to identify targets, they may be relying on patterns derived from personal data—communications, location information, social connections—that have been collected and analyzed without transparency. This creates the risk of erroneous targeting based on flawed data analysis, with potentially lethal consequences.

For commercial clients, Palantir's promise that they are "highly monogamous in the way we work" and "not trying to make you into a commodity" rings hollow to privacy advocates. The company's ability to integrate data across different clients creates the potential for data spillage or unauthorized cross-referencing, violating the data segregation requirements that many contracts with government agencies mandate.

Looking forward, Palantir's continued growth in government contracts will inevitably face increasing regulatory scrutiny. As more jurisdictions enact comprehensive privacy laws similar to GDPR and CCPA, the company's data processing practices will face greater legal challenges. The European Union's proposed AI Act, which would regulate high-risk AI systems like Maven, could impose additional requirements for transparency, human oversight, and risk mitigation.

Privacy experts suggest that Palantir must fundamentally rethink its approach to data protection to maintain legitimacy. This includes implementing robust data governance frameworks, conducting privacy impact assessments for all government contracts, and establishing independent oversight mechanisms to ensure compliance with evolving regulations. Without such changes, the company's claim that "nine tenths of the world loves us" may become increasingly difficult to sustain as privacy awareness grows globally.

As the data mining giant continues to expand its reach into both government and commercial sectors, the tension between its business model and fundamental privacy rights will likely intensify. For the individuals whose data fuels Palantir's algorithms, the company's success represents an ongoing challenge to the right to privacy in the digital age.