X Privacy Policy

This is X's (formerly Twitter) privacy policy, effective January 15, 2026, covering what personal data X collects, how it is used, who it is shared with, and what controls users have. A notable provision states that X may share user data with third-party collaborators who may use it for their own independent purposes, including training AI models, unless the user opts out. The policy also discloses that X collects biometric information with consent, combines data from ad partners with platform-collected data, and retains account and content data for the duration of the account.

This document is X Corp.'s Privacy Policy, effective January 15, 2026, governing the collection, use, sharing, and retention of personal data for all users of the X platform, with X Corp. (Bastrop, TX) identified as the data controller for non-EU/EEA/UK users and X Internet Unlimited Company (Dublin, Ireland) identified as the data controller for EU, EEA, and UK users. The policy states that X collects identifiers, device information, IP addresses, location data, biometric information (with consent), payment information, inferred identity data, browsing and interaction history, and information received from ad partners and third parties; the terms authorize combining data received from ad partners and affiliates with user-provided and platform-collected data, and the policy permits sharing with service providers, advertisers, affiliates, third-party collaborators, and API licensees, including for third parties to use shared data for their own independent purposes such as training AI models unless users opt out. A notable provision authorizes sharing user data with third-party collaborators for independent purposes including AI model training, subject to opt-out rather than opt-in consent, which may engage tension with GDPR consent and legitimate interest frameworks in the EU and EEA; the policy also asserts that public content may persist on third-party platforms after deletion from X, and the English-language version governs in case of translation discrepancy. The policy engages GDPR (with the Irish Data Protection Commission as lead supervisory authority), CCPA, the Washington State My Health My Data Act, the Oregon Consumer Privacy Act, COPPA (for users under 13), and the EU-US, Swiss-US, and UK Extension Data Privacy Frameworks; compliance teams in the EU, California, Washington, and Oregon face distinct obligations, and the opt-out framing for AI training data sharing may require evaluation under GDPR Articles governing lawful basis and data subject rights.

The agreement authorizes X to share user data with third-party collaborators for independent purposes, including AI model training, on an opt-out basis, meaning the sharing occurs by default unless users adjust their settings. The policy establishes that inferred identity data, device identifiers, location data, browsing interactions, and ad partner data may be combined and used for personalized advertising both on and off the X platform. You can manage data sharing preferences, including data sharing with business partners, through the Privacy and Safety settings in your X account.