Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision authorizes X to share user data with unspecified third-party collaborators who may use that data for their own independent purposes, including training generative and non-generative AI models, unless the user opts out through their settings.
This analysis describes what X's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a data sharing pathway to unnamed third parties whose independent use of user data, including AI model training, is not governed by X's Privacy Policy and may extend beyond the uses users would associate with their X account activity. The opt-out mechanism is the primary user control over this sharing, and its adequacy as a legal basis under applicable frameworks is a material compliance consideration.
Interpretive note: The provision does not specify which categories of user data are shared under this arrangement, which third parties qualify as collaborators, or what opt-out mechanisms are technically available, making the practical scope of this disclosure operationally uncertain.
Under this clause, user data may be disclosed to unnamed third parties for independent purposes, including AI model training, unless the user actively opts out via X's settings; the agreement does not specify which third parties are eligible recipients under this provision.
Cross-platform context
See how other platforms handle Third-Party Collaborator AI Training Data Sharing and similar clauses.
Compare across platforms →Monitoring
X has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Depending on your settings, or if you decide to share your data, we may share or disclose your information with third parties. If you do not opt out, in some instances the recipients of the information may use it for their own independent purposes in addition to those stated in X's Privacy Policy, including, for example, to train their artificial intelligence models, whether generative or otherwise.Excerpt from X's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR Articles 6 and 9 (lawful basis for processing), Article 13 (transparency obligations), and Article 17 (right to erasure), as enforced by the Irish Data Protection Commission for EU/EEA users. Under GDPR, sharing data with third parties for their own independent purposes may require either explicit consent or a demonstrable legitimate interest, and an opt-out mechanism may not satisfy the consent standard in all contexts. The CCPA's provisions on sharing personal information for cross-context behavioral advertising and the California Privacy Rights Act's opt-out rights are also implicated for California residents. (2) GOVERNANCE EXPOSURE: High. The opt-out model for third-party AI training data sharing without enumeration of eligible recipients creates material GDPR transparency and lawful basis exposure. The provision's language that recipients may use data for purposes independent of X's policy amplifies the governance surface, as X retains limited contractual control over downstream use once data is shared. (3) JURISDICTION FLAGS: EU/EEA users face the highest exposure given GDPR's requirements for lawful basis and transparency in third-party data sharing. California residents have CCPA/CPRA opt-out rights that may independently apply. Illinois users should note that if shared data includes biometric components, BIPA may impose additional consent requirements on the receiving third party. (4) CONTRACT AND VENDOR IMPLICATIONS: The policy does not name eligible third-party collaborators, making vendor due diligence and data processing agreement audits difficult for enterprise or B2B users. Procurement teams should assess whether their organization's use of X creates downstream data sharing obligations or liability exposure. The policy states that third parties may use data for their own independent purposes, which represents a liability shift that may not align with standard data processing agreement terms. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether the current opt-out mechanism satisfies applicable lawful basis requirements under GDPR and US state privacy laws. A data mapping review should account for the undefined category of third-party collaborators. Contract amendment reviews may be warranted for B2B users who have data processing agreements with X. Regulatory notification obligations may arise if the scope of AI training data sharing is determined to constitute a new processing purpose under existing consent frameworks.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes a data sharing pathway to unnamed third parties whose independent use of user data, including AI model training, is not governed by X's Privacy Policy and may extend beyond the uses users would associate with their X account activity. The opt-out mechanism is the primary user control over this sharing, and its adequacy as a legal basis …
Under this clause, user data may be disclosed to unnamed third parties for independent purposes, including AI model training, unless the user actively opts out via X's settings; the agreement does not specify which third parties are eligible recipients under this provision.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by X.