X Privacy Policy

This document is X's Privacy Policy, effective January 15, 2026, governing the collection, use, retention, and sharing of personal information by X Corp for users of the X platform and affiliated services worldwide. The policy states that X collects information users provide directly (name, email, phone number, date of birth, payment information, location), information created through use of the service (posts, direct messages, search queries, browsing and interaction data, device identifiers, IP addresses, and inferred interests), and information from third-party sources including advertisers, business partners, and other users; the terms authorize use of this information for service operation, personalization, advertising, safety, research, and to train machine learning and AI models. The policy asserts a broad license over public content and authorizes sharing personal data with business partners, advertisers, analytics providers, third-party applications authorized by users, and corporate affiliates, as well as in connection with mergers, acquisitions, or asset sales; it also states that content posted publicly is viewable and searchable by anyone, including non-users. The policy engages the EU General Data Protection Regulation (GDPR) for EEA users, the UK GDPR, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for California residents, and COPPA for users under 13; X designates Twitter International Unlimited Company as the data controller for users outside the US, Canada, and Japan, and X Corp for users within those territories. The policy's inclusion of AI and machine learning training as an authorized use of personal data, combined with the breadth of inferred data collection and cross-context behavioral advertising, creates compliance considerations under GDPR lawful basis requirements, CCPA opt-out rights for sensitive data uses, and the EU AI Act's emerging obligations for AI system developers.