This provision discloses that X relies on standard contractual clauses (SCCs) and participation in the EU-US Data Privacy Framework (DPF), Swiss-US DPF, and UK Extension to the EU-US DPF as the mechanisms for cross-border personal data transfers from the EU, Switzerland, and UK, and states that third-party recipients are required to maintain equivalent data protections.
This analysis describes what X's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal transfer mechanisms X relies upon for personal data flows from the EU, Switzerland, and UK to the US and other jurisdictions; DPF participation subjects X to FTC investigatory and enforcement authority and provides EU/UK/Swiss users with access to the JAMS alternative dispute resolution process and DPF arbitration for unresolved complaints.
Cross-platform context
See how other platforms handle Cross-Border Data Transfers and EU-US Data Privacy Framework and similar clauses.
Compare across platforms →"Before we move data between countries we look at the risks that may be presented to the data and rely on standard contractual clauses (SCCs), where applicable, to ensure your data rights are protected. To request a copy of the SCCs, please contact us here. If data will be shared with a third party, we require them to maintain the same protections over your data that we provide directly. X is a participant in the EU-US Data Privacy Framework (DPF), the Swiss-US DPF and the UK Extension to the EU-US DPF. X complies with the DPF Principles for all its processing of personal data received from the European Union, Switzerland and the UK, in reliance on the EU-US DPF, Swiss-US DPF and UK Extension to the EU-US DPF, respectively.Excerpt from X's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V (international data transfers), which requires an adequacy decision, SCCs, or other approved transfer mechanism for personal data transfers from the EU/EEA.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the legal transfer mechanisms X relies upon for personal data flows from the EU, Switzerland, and UK to the US and other jurisdictions; DPF participation subjects X to FTC investigatory and enforcement authority and provides EU/UK/Swiss users with access to the JAMS alternative dispute resolution process and DPF arbitration for unresolved complaints.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by X.