Governance document

CA-D-000496

Palantir Privacy Statement

Palantir

Last change detected September 11, 2026 Privacy policy

SHA-256: 2525aecdaee201f5024… 8 versions captured 4 changes documented

Get the research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.

View original document at Palantir ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

102 Total

21 High severity

63 Medium severity

18 Low severity

Key Facts

Will Palantir process Sensitive Personal Information without obtaining consent for consumers in Virginia, New Hampshire, Colorado, Connecticut, Delaware, Nebraska, Utah, Texas, and Oregon?

Palantir will not process Sensitive Personal Information without obtaining consent for consumers in Virginia, New Hampshire, Colorado, Connecticut, Delaware, Nebraska, Utah, Texas, and Oregon.

What does Palantir generate by combining data it has collected with information obtained from third parties?

Palantir generates Inferred Data profiles reflecting preferences and likelihood of interest in its products or services by combining data it has collected with information obtained from third parties.

What do Palantir's Inferred Data profiles reflect?

Who controls what personal data is processed using Palantir's products or services?

Palantir acts as a data processor when providing products and services to its customers, meaning customers — not Palantir — control what personal data is processed using those products or services.

Does Palantir process personal information in connection with proposed or actual mergers, purchases, sales, acquisitions, financing due diligence, service transitions, divestitures, bankruptcies, and restructurings?

Palantir processes personal information in connection with proposed or actual mergers, purchases, sales, acquisitions, financing due diligence, service transitions, divestitures, bankruptcies, and restructurings.

What uses or disclosures of Sensitive Personal Information does Palantir restrict?

Palantir restricts use or disclosure of Sensitive Personal Information to performing services or providing goods reasonably expected by an average consumer, preventing or detecting security incidents, and resisting malicious, deceptive, fraudulent, harmful, or illegal actions.

What data transfer agreements does Palantir use?

Palantir uses data transfer agreements based on Standard Contractual Clauses approved by the European Commission, the UK Secretary of State, or the UK Information Commissioner's Office to ensure adequate protection for personal data transferred to recipients in the EEA or UK.

What agreements does Palantir use to ensure adequate protection for personal data transferred to recipients in the EEA or UK?

Does Palantir's Privacy Statement apply to its customers' processing of personal data using Palantir products or services?

Palantir's Privacy Statement does not apply to its customers' processing of personal data using Palantir products or services.

Is Stripe an independent controller of information provided in the course of using Stripe's payment processing service on Palantir platforms?

Stripe is an independent controller of information provided in the course of using Stripe's payment processing service on Palantir platforms.

Stay ahead of the changes

Track Palantir and get the diff the day its terms change.

Monitor Palantir + up to 20 platforms — $4.99/mo →

Summary

This document explains what personal information Palantir collects about you, how it uses that information (including to build profiles and target advertising), and what rights you have over your data. If you are in certain U.S. states, Palantir must get your consent before processing sensitive personal information, and you may opt out of the sale or sharing of your personal information for targeted advertising. Importantly, if a Palantir customer processes your data using Palantir's products, this Statement does not cover that — the customer is responsible.

Analysis

Palantir's Privacy Statement establishes how Palantir collects, uses, and shares personal data in its capacity as a data controller — distinct from its role as a data processor when providing products and services to customers, in which case customers control what personal data is processed and this Statement does not apply. Palantir automatically collects a broad range of technical data from website visitors, combines collected data with third-party information to generate Inferred Data profiles, and uses multiple categories of personal data to target advertisements through third-party platforms. Use and disclosure of Sensitive Personal Information is restricted to enumerated purposes, and processing of Sensitive Personal Information for consumers in specified U.S. states requires affirmative consent. International transfers from the EEA and UK are conducted under Standard Contractual Clauses approved by the European Commission, the UK Secretary of State, or the UK Information Commissioner's Office.

What this means for you

Palantir automatically collects identifying and behavioral data when you visit its websites, and it combines that data with third-party information to build profiles reflecting your preferences and likely interest in its products. Palantir uses these profiles — along with Contact, Professional, Communication, Technical, Transaction, Training and Educational, and Inferred Data — to target advertisements through third-party platforms. If you are a consumer in Virginia, New Hampshire, Colorado, Connecticut, Delaware, Nebraska, Utah, Texas, or Oregon, Palantir must obtain your consent before processing Sensitive Personal Information. Where applicable, you may opt out of the sale of your Personal Information or its sharing for targeted advertising purposes.

Institutional Analysis

Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor Palantir + up to 20 platforms — $4.99/mo → Get the research letter, free

4 important changes detected

8 versions captured · Last updated: August 2026

August 12, 2026

low

What changed Palantir's navigation menu was updated in an update detected on August 12, 2026 to add a 'Sovereign AI' offering link at the top level of the product navigation. This is a navigation and marketing change with no material impact on the privacy statement's terms, conditions, or obligations.

Why this matters This change does not materially affect consumer privacy rights or data processing obligations. The update adds a navigation link to Palantir's 'Sovereign AI' product offering. No changes to the privacy statement's substantive terms, data collection practices, or consumer rights were detected.

View full change record →

August 5, 2026

low

What changed Palantir's Privacy Statement was updated in an update detected on August 5, 2026, with three sentences modified. The document's last-updated date changed from June 2026 to July 2026. Most substantively, the UK complaint procedure was revised: the statement previously directed UK residents to complain to the Information Commissioner's Office; the updated language now offers UK residents the option to lodge complaints directly with Palantir at privacy@palantir.com before or instead of contacting the ICO.

Why this matters The updated terms now offer UK users two pathways to lodge data protection complaints: directly with Palantir at privacy@palantir.com, or with the Information Commissioner's Office. Previously, only the ICO option was explicitly stated. This change does not alter the underlying right to complain; it clarifies an additional procedural option.

View full change record →

June 18, 2026 low

Palantir updated its Privacy Statement on June 18, 2026, involving substantial structural and content changes across 197 added sentences, 87 removed sentences, and 137 modified sentences. The diff shows primarily …

View change record →

June 10, 2026 medium

Palantir updated its Privacy Statement on June 10, 2026, adding a new disclosure category and updating the last-modified date. The updated terms now explicitly state that Palantir discloses personal data …

View change record →

Featured, High severity

Consent required for Sensitive Personal Information processing Compare →

This establishes a consent gate for sensitive data processing for residents of the listed states, meaning Palantir is prohibited from proceeding without affirmative consumer consent.

Added July 10, 2026 Standard Seen across 290 platforms
Creation and use of Inferred Data profiles Compare →

The creation of Inferred Data through data combination means Palantir's profile of an individual may extend beyond what that person directly provided, incorporating external sources.

Added July 10, 2026 Standard Seen across 279 platforms
Palantir acts as data processor for customers Compare →

This role allocation determines where legal responsibility for data processing decisions sits: with the customer, not Palantir, when Palantir's products or services are used.

Added July 10, 2026 Standard Seen across 297 platforms
Processing personal data in business transfers Compare →

Personal data may be disclosed or transferred as part of corporate transactions, including ones that are only proposed and may not be completed, and across a broad range of transaction types.

Added July 10, 2026 Standard Seen across 279 platforms
Sensitive Personal Information use restricted to limited purposes Compare →

The enumerated-purposes restriction limits how Palantir may use Sensitive Personal Information, constraining it to specific categories rather than general business purposes.

Added July 10, 2026 Standard Seen across 279 platforms
Standard Contractual Clauses for EEA UK transfers Compare →

The use of Standard Contractual Clauses is the named legal mechanism Palantir relies on to legitimise international personal data transfers from the EEA and UK, providing a defined level of contractual protection.

Added July 10, 2026 Standard Seen across 288 platforms
Statement does not apply to customer data processing Compare →

The exclusion means individuals whose data is processed by a Palantir customer through Palantir's products cannot rely on this Statement for rights or protections in that context.

Added July 10, 2026 Standard Seen across 297 platforms
Stripe is independent controller of payment data Compare →

Stripe's status as an independent controller means Palantir's privacy practices and this Statement do not govern how Stripe handles payment processing data; Stripe's own policies apply.

Added July 10, 2026 Standard Seen across 297 platforms
Use of personal data to target advertising Compare →

The breadth of data categories used for targeting — including inferred data and data shared with third-party platforms — means a wide profile of an individual may drive advertising directed at them.

Added July 10, 2026 Standard Seen across 279 platforms
US right to opt out of sale or sharing Compare →

This opt-out right, where applicable, gives consumers a mechanism to limit Palantir's ability to sell or share their Personal Information for commercial targeting or data sale purposes.

Added July 10, 2026 Standard Seen across 290 platforms
Websites not intended for children under 16 Compare →

“Our websites are not intended for children under 16 years of age. If you become aware that your child has provided us with personal data without your consent, …”

Added July 10, 2026 Standard Seen across 245 platforms

Featured, Medium severity

Automatic collection of Technical Data on website visitors Compare →

The automatic and passive nature of this collection means visitors do not need to take any affirmative action for Palantir to gather a wide set of identifying and behavioral data.

Added July 10, 2026 Standard Seen across 296 platforms