Dropbox Privacy Policy

This document is Dropbox's global Privacy Policy, governing how Dropbox, Inc. collects, uses, stores, shares, and protects personal data across its file storage, collaboration, and productivity services, with the stated legal basis varying by jurisdiction (contract performance, legitimate interests, and consent as applicable under GDPR for EEA users). The policy states that Dropbox collects account information, payment details, usage data, device identifiers, location data, and the content users upload and store, and the terms authorize sharing of personal data with third-party service providers, advertising partners, and in connection with business transfers such as mergers or acquisitions. Notably, the policy asserts broad authority to scan and analyze user content for purposes including safety, spam detection, and service improvement, and it reserves the right to share aggregated or de-identified data without restriction; the scope of content analysis for AI or machine learning purposes warrants close reading, as applicable law in certain jurisdictions may constrain how these terms apply in practice. The policy engages GDPR and the EU-U.S. Data Privacy Framework for international data transfers, CCPA/CPRA for California residents, and the UK GDPR post-Brexit; material compliance considerations include the adequacy of transfer mechanisms for EEA-to-US data flows, the sufficiency of consent mechanisms for cookie-based tracking, and the operationalization of data subject rights including access, deletion, and portability.