7 Total
1 High severity
4 Medium severity
2 Low severity
Summary

This document establishes Twilio's data collection and processing practices for visitors to twilio.com and individuals who express interest in Twilio products. Twilio collects name, email address, phone number, company information, and website browsing activity, and discloses this information to marketing, analytics, and advertising partners including Google, Adobe, and Segment. The notice specifies data subject rights available to California residents and EU/UK users, including rights to access, delete, or opt out of certain processing, exercisable through the privacy request portal at https://privacy.twilio.com.

Technical / Legal Breakdown

This document is Twilio's Website Privacy Notice, governing the collection, use, and disclosure of personal information from visitors to Twilio's website and individuals who interact with Twilio in a business development context, with stated legal bases including consent, legitimate interests, and contractual necessity depending on jurisdiction. The notice states that Twilio collects identifiers (name, email, phone number, company name), device and usage data (IP address, browser type, operating system, pages visited, clickstream data), location-derived data, and inferred preferences, and the terms authorize sharing this information with advertising, analytics, marketing, and operational service providers as well as corporate affiliates. The notice describes a broad behavioral advertising and analytics ecosystem, including use of cookies, pixel tags, and third-party tracking technologies from vendors such as Google Tag Manager, Adobe Launch, Segment, and Visual Website Optimizer, which is operationally consistent with enterprise SaaS marketing practices though the scope of third-party data sharing may warrant review under applicable privacy frameworks. The notice engages GDPR and UK GDPR for EU and UK residents, CCPA and CPRA for California residents, and references additional state privacy laws, with Twilio asserting it does not sell personal information in the CCPA sense but acknowledging that sharing for targeted advertising may constitute a sale or sharing under certain state laws. Material compliance considerations include the adequacy of consent mechanisms for cookie-based tracking, the sufficiency of the legitimate interests basis under GDPR for marketing processing, and the scope of data subject rights disclosures across jurisdictions, all of which depend on enforcement context and applicable law.

Institutional Analysis

Institutional analysis available with Professional

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.

Start Professional free trial

7 important changes detected

7 versions captured · Last updated: May 2026

May 19, 2026

medium
What changed Twilio updated its privacy notice on May 19, 2026 to provide more explicit detail about its Data Privacy Framework (DPF) compliance and certification. The revised language states that Twilio Inc. and subsidiary Stytch Inc. certify compliance with the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF as set by the U.S. Department of Commerce. The update also clarifies that if DPF Principles conflict with other terms in the privacy notice, the DPF Principles govern. Additionally, the notice now explicitly describes opt-out choices for third-party disclosures and uses that differ from original collection purposes, and identifies JAMS as the specific dispute resolution provider for DPF-related complaints.
Why this matters The updated notice establishes more explicit disclosures of Twilio's Data Privacy Framework certifications and specifies the legal hierarchy governing data processing. Under the revised policy, the DPF Principles now take precedence if they conflict with other terms in the privacy notice. The updated language also clarifies your right to opt out of third-party disclosures (except to service providers acting on Twilio's behalf) and to opt out of uses that materially differ from original collection purposes. You can exercise these choices by contacting privacy@twilio.com.
View full change record →
What changed Twilio's privacy notice now includes a specific statement that it does not sell personal data to third parties for marketing or promotional purposes. The prior language stated the company does not sell data generally. The updated version narrows this commitment by specifying that while certain categories of personal data may be shared for business purposes, mobile information specifically will not be shared or sold for marketing or promotional purposes. This creates a more detailed disclosure of what data may or may not be used for marketing.
Why this matters The updated privacy notice now specifies that mobile information will not be shared or sold for marketing or promotional purposes, though the policy states that certain categories of personal data may still be shared for other business purposes. The change provides greater clarity about which data types receive explicit marketing-use restrictions versus which data may be used for other business operations. You can review Twilio's privacy notice to understand which specific data categories fall under each category of permitted sharing.
View full change record →

May 1, 2026 low

Twilio's Privacy Notice table of contents was updated on May 1, 2026 to add a reference to 'Twilio Messaging Campaign Terms' in the list of linked legal documents. The prior …

View change record →
April 19, 2026 low

Twilio substantially restructured its Privacy Notice on April 19, 2026, replacing detailed operational descriptions with a principles-based framework centered on Binding Corporate Rules. The prior version explicitly described the types …

View change record →
April 10, 2026 low

Twilio substantially reorganized and rewrote its Privacy Notice as of April 9, 2026, replacing 120 sentences with new language. The updated notice removes the prior sectional explanation of direct and …

View change record →
March 28, 2026 low

Twilio corrected a typo in their privacy notice URL on March 28, 2026. The previous version stated the URL as 'https://www/twilio.com/legal/privacy' (missing the dot between 'www' and 'twilio'), while the …

View change record →
March 19, 2026 medium

Twilio substantially reorganized and expanded its Privacy Notice on March 19, 2026, shifting from a brief marketing-focused introduction to a detailed explanation of data collection and processing practices. The updated …

View change record →
High — 1 provision
Medium — 4 provisions
Low — 2 provisions

Monitoring

Twilio has updated this document before.

Watcher includes same-day alerts, structured change summaries, and monitoring for up to 10 platforms.

Start Watcher free trial Or create a free account →

Professional Governance Intelligence

Need provision-level monitoring and regulatory mapping?

Professional includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.

Start Professional free trial

Cross-platform context

See how other platforms handle Data Sharing with Advertising and Analytics Partners and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

ePrivacy Directive
European Union
View official text ↗
Archival ProvenanceSource & Archival Record
Last Captured May 19, 2026 00:28 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000252
Version ID CA-V-002723
SHA-256 a4a3739040fcfcfee702f9dde1f1911f4986a957578b5fbc26065971ffb592c4
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.

Create free account Compare plans