The policy states that X may associate multiple browsers and devices with a user's account, including devices used while signed out, and may infer additional identity information by associating accounts with hashed email addresses sharing components with the user's provided email address.
This analysis describes what X's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes cross-device identity inference and association beyond the device or browser used for sign-in, including for signed-out users, which has implications for the scope of behavioral tracking and targeted advertising across X's ecosystem.
⚠ If account settings are not adjusted, X's terms permit cross-device association and identity inference as described, including for signed-out browsing sessions.
Cross-platform context
See how other platforms handle Inferred Identity and Cross-Device Association and similar clauses.
Compare across platforms →"When you sign into X on a browser or device, we will associate that browser or device with your account. Subject to your settings, we may also associate your account with browsers or devices other than those you use to sign into X (or associate your signed-out device or browser with other browsers or devices or X-generated identifiers). When you provide other information to X, including an email address or phone number, we associate that information with your X account. Subject to your settings, we may also use this information in order to infer other information about you and/or your identity, for example by associating your account with hashes of email addresses that share common components with the email address you have provided to X.Excerpt from X's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR's requirements on transparency, purpose limitation, and profiling for EU users, as well as CCPA's provisions on the collection of identifiers and inferences drawn from personal information.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision authorizes cross-device identity inference and association beyond the device or browser used for sign-in, including for signed-out users, which has implications for the scope of behavioral tracking and targeted advertising across X's ecosystem.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by X.