Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The notice states that Twilio Inc. and its subsidiary Stytch Inc. are certified under the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF, that DPF Principles govern in the event of conflict with the notice, and that Twilio is subject to FTC investigatory and enforcement powers.
This analysis describes what Segment's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal framework governing international transfers of personal data from the EU, UK, and Switzerland to Twilio's U.S. operations, and names the FTC as the U.S. enforcement authority. The DPF Principles' priority over the privacy notice in cases of conflict is operationally significant for assessing which obligations govern specific processing activities.
The updated policy establishes a new opt-out mechanism allowing users to decline having their data disclosed to third parties (other than service providers) or used for purposes materially different from the original collection purpose. The policy also explicitly discloses that Twilio Inc. is subject to FTC investigatory and enforcement powers, providing users with notice of the regulatory authority overseeing the company's privacy practices. You can exercise this opt-out right by contacting Segment through the mechanism specified in their privacy policy.
View change record →The updated terms establish clearer disclosure of how Segment transfers personal data internationally. Segment now explicitly certifies its compliance with the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework, and states that these DPF Principles take precedence if they conflict with other policy terms. The updated policy also adds specific rights allowing you to opt out of: (i) disclosure of your personal data to third parties other than service providers acting under Segment's instructions, or (ii) use of your personal data for purposes materially different from the original purpose or your subsequent authorization. You can exercise these rights by contacting privacy@twilio.com.
View change record →The agreement establishes that EU, UK, and Swiss residents whose data is transferred to Twilio's U.S. operations are protected under the DPF framework, with access to a free third-party dispute resolution process through JAMS and, under certain conditions, binding arbitration. The DPF Principles govern over the notice terms in cases of conflict.
Cross-platform context
See how other platforms handle Data Privacy Framework Certification and FTC Enforcement and similar clauses.
Compare across platforms →Monitoring
Segment has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Twilio Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. ... If there is any conflict between the terms in this Privacy Notice and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. Twilio Inc. is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).Excerpt from Segment's Privacy Policy
1) REGULATORY LANDSCAPE: The EU-U.S. DPF was adopted by the European Commission in 2023 and provides a mechanism for lawful transfer of personal data from the EU to certified U.S. organizations. The UK Extension and Swiss-U.S. DPF provide analogous mechanisms for UK and Swiss transfers. The FTC has enforcement authority over DPF compliance. The DPF's legal status may be subject to future legal challenge before EU courts, which is a material risk for organizations relying on it as a sole transfer mechanism. 2) GOVERNANCE EXPOSURE: Medium. Twilio's reliance on DPF certification for EU-U.S., UK, and Swiss transfers is a recognized legal mechanism but carries the systemic risk that the DPF could be invalidated or modified following legal challenge, as occurred with the predecessor Privacy Shield framework. Organizations relying on Twilio's DPF certification as a transfer mechanism should monitor DPF legal status. 3) JURISDICTION FLAGS: EU organizations and those subject to GDPR face the primary exposure in the event of DPF invalidation. The notice states that SCCs and BCRs are also available as transfer mechanisms, which provides layered protection. UK organizations should note the separate UK Extension mechanism and the ICO's role in UK data transfers. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers relying on Twilio's DPF certification as the primary transfer mechanism for their own GDPR compliance programs should maintain contingency documentation for SCC or BCR reliance. DPAs should confirm which transfer mechanisms apply to specific processing activities and geographies. 5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that Twilio's DPF certification at https://www.dataprivacyframework.gov/ is current and covers all relevant data processing activities. Transfer impact assessments should account for the DPF's legal status and document alternative transfer mechanisms. The notice's statement that DPF Principles govern over conflicting notice terms should be factored into any assessment of applicable obligations.
This provision establishes the legal framework governing international transfers of personal data from the EU, UK, and Switzerland to Twilio's U.S. operations, and names the FTC as the U.S. enforcement authority. The DPF Principles' priority over the privacy notice in cases of conflict is operationally significant for assessing which obligations govern specific processing activities.
The agreement establishes that EU, UK, and Swiss residents whose data is transferred to Twilio's U.S. operations are protected under the DPF framework, with access to a free third-party dispute resolution process through JAMS and, under certain conditions, binding arbitration. The DPF Principles govern over the notice terms in cases of conflict.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Segment.