Twilio expanded its Data Privacy Framework (DPF) disclosures to explicitly state that it and its subsidiary Stytch Inc. are certified under the EU-U.S., UK, and Swiss-U.S. DPF frameworks, and that it remains liable for third-party data processors acting on its behalf. The updated policy also adds specific opt-out rights for data disclosure to third parties and use for materially different purposes, establishes a 30-day acknowledgment timeline for complaints, and clarifies dispute resolution procedures including escalation to the UK Information Commissioner's Office and FTC oversight.
Consumers: You can now opt out of having your data shared with third parties or used for new purposes, by contacting privacy@twilio.com.
Consumers: If you complain about Twilio's privacy practices as a UK resident, Twilio will acknowledge your complaint within 30 days and work to resolve it; if unsatisfied, you can escalate to the UK ICO.
Data controllers: Twilio is now explicitly liable if its third-party data processors violate DPF Principles, unless Twilio can prove it did not cause the violation.
The updated terms establish explicit certification under the EU-U.S., UK, and Swiss-U.S. Data Privacy Frameworks, meaning Twilio commits to comply with DPF Principles in processing personal data from those regions. The policy now states that Twilio remains liable if third-party processors acting on its behalf violate DPF Principles, unless Twilio proves it was not responsible for the violation. The revised language adds specific opt-out rights: you can opt out of disclosure of your personal data to third parties (other than service providers following Twilio's instructions) or use of your data for purposes materially different from the original collection purpose. For UK residents, the policy establishes a 30-day acknowledgment timeline for complaints and clarifies that unresolved complaints may be escalated to the UK Information Commissioner's Office. You can exercise these rights by contacting privacy@twilio.com.
→ Review the DPF opt-out rights and contact privacy@twilio.com if you wish to opt out of data disclosure to third parties or use for materially different purposes.
→ If you are a UK resident and have a privacy concern, submit your complaint directly to Twilio at privacy@twilio.com; if unresolved after Twilio's response, escalate to the UK Information Commissioner's Office at www.ico.org.uk.
Twilio remains liable for DPF violations by third-party processors unless it proves it was not responsible for the violation.
Consumers can opt out of data disclosure to third parties and use for materially different purposes by contacting privacy@twilio.com.
Twilio will acknowledge complaints within 30 days and work to resolve; unresolved complaints may be escalated to the UK Information Commissioner's Office.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
Twilio has expanded its DPF certification disclosures to explicitly cover EU-U.S., UK, and Swiss-U.S. frameworks and added language establishing liability for third-party processors. The policy now includes specific opt-out mechanisms for data sharing and secondary …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-002179.
Twilio added two new disclosures to its Privacy Notice: an explicit statement that it is subject to FTC investigatory and …
Twilio revised its Terms of Service to add new regional entities for Mexico and Brazil, clarify that Order Forms now …
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.