X Privacy Policy

This is X's (formerly Twitter) privacy policy, covering what data X collects from users, how it is used, and with whom it is shared across all X platform services globally. The policy discloses that X may share user data with third-party collaborators who can use that data for their own independent purposes, including training their own AI models, unless users opt out; it also states that X may use collected and publicly available user information to train X's own machine learning and AI models. The policy additionally discloses that X may collect biometric information with user consent, retains profile and usage data for the duration of an account, and keeps cookie-collected data for up to 13 months and ad interaction data for up to 12 months.

This document is X Corp.'s Privacy Policy, effective January 15, 2026, governing the collection, use, sharing, and retention of personal data for users of the X platform globally, with X Corp. identified as the data controller for US and non-EU/EEA/UK users, and X Internet Unlimited Company as the data controller for EU, EEA, and UK users. The policy states that X collects identifiers, device information, location data, browsing and interaction activity, biometric information (with consent), payment data, and inferred identity information; the terms authorize use of collected and publicly available information to train machine learning and artificial intelligence models, and authorize sharing with third-party collaborators who may use data for their own independent purposes including training their own AI models, unless users opt out. A notable provision discloses that third-party collaborators receiving user data may use it for purposes beyond those stated in X's policy, including AI model training, subject to an opt-out mechanism whose scope and accessibility are not fully specified in the policy text; the policy also reserves the right to infer identity across signed-out devices and browsers and to associate accounts with hashed email address components. The policy engages GDPR and the EU-US Data Privacy Framework (DPF), CCPA, Washington State's My Health My Data Act, Oregon's Consumer Privacy Act, and COPPA, with X identifying the Irish Data Protection Commission as the lead supervisory authority for EU users and noting DPF participation subject to FTC investigatory and enforcement authority. Material compliance considerations include the breadth of AI training data use authorizations, the opt-out framing for third-party AI model training data sharing, the cross-border data transfer mechanisms (SCCs and DPF), and age verification obligations under multiple jurisdictions.

The agreement authorizes X to use collected user data and publicly available information to train its own machine learning and AI models, and to share user data with third-party collaborators who may use it for their own independent purposes, including AI model training, unless users opt out. The policy establishes retention periods ranging from 12 months for ad interaction data and cookie data to the full duration of an account for profile and usage information, with indefinite retention of identifiers for users suspended for policy violations. You can adjust data sharing preferences for third-party collaborators through X's Privacy and Safety settings, and manage additional privacy controls through account settings.