Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision states that X receives browser cookie IDs, device IDs, hashed email addresses, demographic data, and behavioral data from ad partners, and may collect similar data directly from advertiser websites and apps via integrated advertising technology; this data may be combined with user-provided and platform-collected data.
This analysis describes what X's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause establishes that X's data collection extends to off-platform behavioral data sourced from advertiser websites and apps, and that this data is combined with on-platform data to build user profiles for advertising purposes. The scope of this data combination is relevant to GDPR's transparency requirements and CCPA's disclosure obligations for data collected from third-party sources.
⚠ The terms permit X to combine off-platform ad partner data with user account data for advertising purposes as described unless the user adjusts advertising-related privacy settings
Cross-platform context
See how other platforms handle Ad Partner Data Combination and Off-Platform Tracking and similar clauses.
Compare across platforms →Monitoring
X has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Our ad and business partners share information with us such as browser cookie IDs, X-generated identifiers, mobile device IDs, hashed user information like email addresses, demographic or interest data, and content viewed or actions taken on a website or app. Some of our ad partners, particularly our advertisers, also enable us to collect similar information directly from their website or app by integrating our advertising technology. Information shared by ad partners and affiliates or collected by X from the websites and apps of ad partners and affiliates may be combined with the other information you share with X and that X receives, generates, or infers about you described elsewhere in this Privacy Policy.Excerpt from X's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR's transparency, purpose limitation, and third-party data sourcing requirements, CCPA's right to know about sources of personal information, and FTC guidelines on online behavioral advertising and data broker practices. The Irish DPC has authority for EU and EEA users; the FTC has authority for US users. 2) GOVERNANCE EXPOSURE: Medium. The combination of off-platform behavioral data with on-platform data for advertising profiling is a standard industry practice but is subject to increasing regulatory scrutiny, particularly in the EU where GDPR requires disclosure of third-party data sources and may require a documented lawful basis for this processing. California residents have a right under CCPA to know the categories of sources from which personal information is collected. 3) JURISDICTION FLAGS: EU and EEA users may have rights to object to processing for direct marketing and to obtain information about third-party data sources under GDPR. California residents are entitled to know about third-party data sources and to opt out of the sale or sharing of their personal information, which the combined profiling practice may constitute under CPRA. Washington and Oregon residents have similar rights under their state privacy laws. 4) CONTRACT AND VENDOR IMPLICATIONS: Advertisers who integrate X's advertising technology on their websites or apps should ensure that their own privacy notices disclose this data sharing to their users. Failure to do so may create liability for the advertiser under applicable privacy law, independent of X's obligations. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether X's opt-out mechanisms for advertising data sharing are operationally effective and consistent with the scope of data combination described in this provision. Privacy notices and cookie consent banners deployed by advertisers using X technology should be reviewed to ensure they accurately describe data flows to X.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This clause establishes that X's data collection extends to off-platform behavioral data sourced from advertiser websites and apps, and that this data is combined with on-platform data to build user profiles for advertising purposes. The scope of this data combination is relevant to GDPR's transparency requirements and CCPA's disclosure obligations for data collected from third-party sources.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by X.