xAI · xAI Terms of Service · View original document ↗

Third-Party Login Data Access

Medium severity High confidence Explicitdocumentlanguage Unique · 0 of 343 platforms
Share 𝕏 Share in Share 🔒 PDF
Monitor governance changes for xAI Create a free account to receive the weekly governance digest and monitor one platform for governance changes.
Create free account No credit card required.
Document Record

What it is

If you log into Grok using Google, Apple, or X, you give xAI permission to access account information from those services. If you use X to log in and opt in, xAI can access your full X post history, location information, preferences, usage data, and Grok conversation history from X.

This analysis describes what xAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology

ConductAtlas Analysis

Why it matters (compliance & governance perspective)

The optional X login integration permits xAI to access an extensive profile including post history from all accounts you can view on X (both public and protected), date of birth, and location information, subject to user opt-in.

Consumer impact (what this means for users)

The agreement authorizes xAI to access third-party service data upon login, including for X accounts: user profile with date of birth, location information, post history from all viewable accounts including protected accounts, usage data, and Grok conversation history on X. The X data import is described as an opt-in, not a default.

How other platforms handle this

Ledger Medium

At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.

Garmin Medium

If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...

Strava Medium

We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...

See all platforms with this clause type →

Monitoring

xAI has changed this document before.

Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.

Start Monitor free trial Or create a free account →
▸ View Original Clause Language DOCUMENT RECORD
"
By choosing to login to our Service by using a third-party service, such as Google, Apple, or X, you give us permission to access, use, and store your information from that service, as permitted by that service, which may include log-in credentials and/or access tokens for that service. If connecting to our Service using your X credentials, you may elect (opt-in) to bring your X user profile (including date of birth), X account and location information, X preferences, X post history (your X posts viewable on your X account including posts to and from all accounts (public or protected) that you can view), X usage data, and your Grok in X conversation history to your xAI account.

— Excerpt from xAI's xAI Terms of Service

ConductAtlas Analysis

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Access to third-party platform data including post history from protected accounts and date of birth implicates GDPR Articles 6 and 9 for EEA users, and CCPA for California residents. The access to protected account posts viewed by the user, rather than solely the user's own public posts, is an operationally distinctive element that may implicate the privacy rights of third parties whose protected posts are accessible to the logging-in user. The Stored Communications Act may be relevant to access to private or protected social media content. (2) GOVERNANCE EXPOSURE: Medium to High. The scope of X data accessible through the opt-in integration is broad, including date of birth (a sensitive data element under some privacy frameworks), location information, and third-party protected posts visible to the user. Users enabling this feature should understand the breadth of data transferred to xAI. (3) JURISDICTION FLAGS: GDPR-regulated users should be aware that date of birth may qualify as sensitive personal data in certain processing contexts, and that the transfer of third-party protected post content to xAI may raise data protection questions regarding the rights of the original posters. CCPA sensitive personal information provisions may apply to date of birth and location data. (4) CONTRACT AND VENDOR IMPLICATIONS: The data access is described as permitted by the third-party service's own terms; procurement teams and users should review X's current terms of service and developer policies to understand what data xAI is authorized to receive through this integration. (5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the opt-in disclosure is sufficiently clear and conspicuous to constitute informed consent under GDPR and CCPA, particularly regarding the inclusion of protected third-party post content. A data mapping exercise should capture the categories of X data transferred to xAI through this integration.

Full compliance analysis

Regulatory citations, enforcement risk, and due diligence action items.

Track 1 platform — free Try Monitor free for 14 days

Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.

Applicable agencies

  • FTC
    The FTC has jurisdiction over data collection and third-party data sharing practices under the FTC Act, including the adequacy of disclosure and consent for accessing third-party platform data.
    File a complaint →

Applicable regulations

EU AI Act
European Union
CCPA/CPRA
California, USA
Colorado AI Act
US-CO
Connecticut Data Privacy Act Amendments
US-CT
CAN-SPAM
United States Federal
EU AI Act - High Risk Provisions
EU
FTC Act Section 5
United States Federal
GDPR
European Union
Indiana Consumer Data Protection Act
US-IN
Kentucky Consumer Data Protection Act
US-KY
UK GDPR
United Kingdom
Universal Opt-Out Mechanism Expansion 2026
US

Provision details

Document information
Document
xAI Terms of Service
Entity
xAI
Document last updated
May 5, 2026
Tracking information
First tracked
May 8, 2026
Last verified
May 12, 2026
Record ID
CA-P-009783
Document ID
CA-D-00327
Evidence Provenance
Source URL
Wayback Machine
Content hash (SHA-256)
fbcda0ec0bb33eba1935039e132a19676af37212d42f1dfa3668d5a855803878
Analysis generated
May 8, 2026 10:51 UTC
Methodology
Evidence
✓ Snapshot stored   ✓ Hash verified
Citation Record
Entity: xAI
Document: xAI Terms of Service
Record ID: CA-P-009783
Captured: 2026-05-08 10:51:01 UTC
SHA-256: fbcda0ec0bb33eba…
URL: https://conductatlas.com/platform/xai/xai-terms-of-service/third-party-login-data-access/
Accessed: July 4, 2026
Permanent archival reference. Stable identifier suitable for legal filings, compliance documentation, and research citation.
Classification
Severity
Medium
Categories

Other risks in this policy

Related Analysis

Compliance Governance Intelligence

Need to monitor specific governance provisions?

Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.

Arbitration clauses AI governance Data rights Indemnification Retention policies
Start Compliance free trial

Or start with Monitor →

Built from archived source documents, structured governance mappings, and historical version tracking.

Frequently Asked Questions

What does xAI's Third-Party Login Data Access clause do?

The optional X login integration permits xAI to access an extensive profile including post history from all accounts you can view on X (both public and protected), date of birth, and location information, subject to user opt-in.

How does this clause affect you?

The agreement authorizes xAI to access third-party service data upon login, including for X accounts: user profile with date of birth, location information, post history from all viewable accounts including protected accounts, usage data, and Grok conversation history on X. The X data import is described as an opt-in, not a default.

Is ConductAtlas affiliated with xAI?

No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by xAI.