X (Twitter) Terms of Service & Privacy Policy
X (Twitter)
Very Bad
Based on a complete review of both the Terms of Service and Privacy Policy, X collects a vast amount of your data, grants itself very broad rights to your content (including for AI training), and imposes highly restrictive legal terms on users.
Source: https://x.com/en/tos
Account & Identity Data
When you create an account, you provide your display name, username, password, email or phone number, date of birth, and language. For professional accounts, this includes professional category, street address, and contact information, which will be public. You can also choose to share your location in your profile and upload your address book.
Payment Information
If you use paid services, you provide credit/debit card details, expiration date, CVV, and billing address.
Biometric Information
Based on your consent, X may collect and use your biometric information for safety, security, and identification.
Job-Related Data
If you use job application/recommendation features, X collects biographical info, employment/educational history, preferences, skills, and job search activity.
Usage & Interaction Data
X collects data on your activity, including posts, broadcast activity (Spaces), lists, bookmarks, communities, interactions (reposts, likes, DMs, mentions), and links you click. If you communicate with X, they collect information about the communication content.
Device & Connection Data
X collects your IP address, browser type, device and advertising IDs, operating system, carrier, language, memory, installed apps, and battery level. Your device address book may be collected if you share it.
Location Data
X collects your approximate location to provide services and relevant ads. You can also choose to share your precise location.
Inferred Identity & Log Data
X may infer your identity by associating your account with browsers/devices, or by using your email/phone. They also collect log information (IP, browser, OS, referring page, access times, pages visited, search terms, ad IDs, cookie identifiers) even if you're signed out or don't have an account.
Advertising & Third-Party Interaction Data
X collects information when you view or interact with ads on or off X. When you view X content on third-party websites (e.g., embedded posts), X may receive log information about the page you visited.
Data from Partners & Affiliates
X receives data from ad partners, developers, and publishers (e.g., cookie IDs, device IDs, hashed emails, demographic data, content viewed on other sites/apps). This data can be combined with other information X has about you. X also receives data from other third parties, content evaluators, and services you link to your X account.
Service Operation, Improvement & Personalization
X uses your data to provide and operate its services, personalize your experience (showing relevant content/ads, suggesting follows), and enable connections. This includes using your data to train their machine learning and artificial intelligence models.
Safety & Security
X uses your information to verify identity and age, authenticate accounts, prevent fraud, and enforce policies and terms.
Measurement & Analytics
X analyzes how you use its services to measure effectiveness and make improvements.
Communication
X uses your data to communicate about product updates, policy changes, and send marketing messages.
Research
X uses your data for internal research, surveys, product testing, and troubleshooting.
Public Sharing
Your profile information and posts are publicly viewable and searchable, even by people not signed into X, and can appear in search engines or be reshared elsewhere.
Sharing with Other X Users
Your interactions and direct messages (if shared via third-party services) are shared with other X users.
Sharing with Partners & Service Providers
X shares your information with service providers (e.g., payment processors, hosting, analytics, fraud detection) and other partners to operate its services. You have some control over data sharing with certain business partners.
Sharing with Advertisers
Advertisers can learn from your engagement with their ads on or off X. X's advertising technology may also directly collect information like cookie identifiers or IP addresses from advertisers' websites/apps.
Sharing with Third-Party Collaborators
X may share your information with third parties who can use it for their own independent purposes, including training their artificial intelligence models, unless you opt out.
API Access
Public X information is made available via APIs and embeds to websites, apps, and others for display and analysis, often for a fee for large-scale access.
Legal & Safety Disclosures
X may preserve, use, share, or disclose your information to comply with laws, regulations, legal processes, governmental requests, protect safety, explain content removal, address security issues, or protect its rights/property. This includes inferring and sharing age/identity for regulatory and security purposes.
Sharing with Affiliates
X shares information among its corporate affiliates to provide services.
Business Transfers
Your information may be shared, sold, or transferred in connection with mergers, acquisitions, or other changes in ownership.
International Data Transfers
X moves your data across borders to support its global services, relying on mechanisms like Standard Contractual Clauses (SCCs) and participating in the EU-US Data Privacy Framework (DPF).
Content License for AI Training & Third-Party Use
HIGH RISK“you grant us a worldwide, non-exclusive, royalty-free license (with the right to sublicense) to use, copy, reproduce, process, adapt, modify, publish, transmit, display, upload, download, and distribute such Content... for any purpose... including, for example, for use with and training of our machine learning and artificial intelligence models... and to make Content... available to other companies, organizations or individuals... with no compensation paid to you...”
This means: You give X a very broad, permanent, royalty-free license to use anything you post, create, or generate on the platform. This includes using your content to train X's own AI models and allowing other companies to use it, all without paying you anything.
Limited Liability for Service Issues
MEDIUM RISK“The Services are provided to you on an “AS IS” and “AS AVAILABLE” basis... THE X ENTITIES DISCLAIM ALL WARRANTIES AND CONDITIONS... THE X ENTITIES SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES... IN NO EVENT SHALL THE AGGREGATE LIABILITY OF THE X ENTITIES EXCEED THE GREATER OF ONE HUNDRED U.S. DOLLARS (U.S. $100.00) OR THE AMOUNT YOU PAID US, IF ANY, IN THE PAST SIX MONTHS FOR THE SERVICES GIVING RISE TO THE CLAIM.”
This means: X offers its services 'as is,' meaning they don't guarantee perfect operation or freedom from errors. They also severely limit their financial responsibility for any damages you might incur, typically capping it at $100 or the amount you've paid them in the last six months.
Waiver of Class Action Rights
HIGH RISK“To the extent permitted by law, you also waive the right to participate as a plaintiff or class member in any purported class action, collective action or representative action proceeding against us or our corporate affiliates.”
This means: You give up your right to join a class-action lawsuit against X. If you have a dispute, you must pursue it individually, which can be a significant barrier for most users.
Shortened Statute of Limitations
HIGH RISK“You and X agree that you must initiate any proceeding or action asserting a federal claim within one (1) year... any state law claim within two (2) years... Otherwise... you forever waive the right to pursue any claim or cause of action...”
This means: You have a very limited time (1-2 years) to file a lawsuit against X, depending on the type of claim. This is much shorter than typical legal deadlines and means if you miss this window, you lose your right to sue them.
Mandatory Jurisdiction (Non-EU/UK/EFTA Users)
HIGH RISK“all disputes related to these Terms... shall be brought and must proceed exclusively in the federal or state courts located in Tarrant County, Texas, United States, and you consent to personal jurisdiction in those forums and waive any objection as to inconvenient forum.”
This means: If you live outside the EU, UK, or EFTA (including the US), any legal dispute you have with X must be filed and heard exclusively in Tarrant County, Texas, regardless of where you live. This makes it very difficult and expensive for most users to pursue legal action.
Mandatory Jurisdiction (EU/UK/EFTA Users)
MEDIUM RISK“all disputes related to these Terms... shall be brought and must proceed exclusively before a competent court in Ireland without regard to conflict of law provisions and will be governed by Irish law...”
This means: If you live in the EU, UK, or EFTA, any legal dispute you have with X must be filed and heard exclusively in Ireland, and Irish law will apply. While this is where X's EU entity is based, it still centralizes all disputes to a single foreign jurisdiction.
Liquidated Damages for Misuse
HIGH RISK“if you violate the Terms, or you induce or knowingly facilitate others to do so... you will be jointly and severally liable to us for liquidated damages as follows for requesting, viewing, or accessing more than 1,000,000 posts... - $15,000 USD per 1,000,000 posts.”
This means: If you violate the terms, particularly by scraping or excessively accessing posts (e.g., more than 1 million posts in 24 hours), X can charge you a fixed penalty of $15,000 for every million posts, in addition to other legal remedies. This is a significant financial penalty for certain types of platform misuse.
Delete your account
You can deactivate your account, which makes it unviewable for 30 days, after which it is queued for deletion. Instructions are provided in the Help Center.
Data retention
X retains different types of data for varying periods. Profile, usage, and payment info are kept for the duration of your account. Communications are kept for up to 18 months, and cookie data for up to 13 months. Data from ads and partners is kept for up to 12 months. Importantly, identifiers for suspended accounts may be kept indefinitely to prevent repeat policy violations. Data may be kept longer for legal compliance or security reasons. Public content, once posted, may persist on third-party sites and search engines even after deletion from X.
Data portability
You can download a copy of your X archive, which includes your posts and other information.
Biometric Information Collection
X states it may collect and use your biometric information (with consent) for safety, security, and identification. Biometric data is highly sensitive and carries unique risks if compromised.
Industry context: While some services use biometrics for login, collecting it for broader 'safety, security, and identification' is a significant expansion and higher risk than typical.
Extensive Device Data & Inferred Identity
X collects detailed device information, including installed apps, memory, and battery level. They also infer your identity even when you're signed out or don't have an account, linking various identifiers to build a comprehensive profile.
Industry context: Collecting data on 'installed apps' is unusually intrusive. Inferring identity when signed out is a common but aggressive practice for ad targeting and user tracking, leaning towards worse than normal due to its breadth.
Broad Content License for AI Training & Third-Party Use
You grant X a worldwide, royalty-free license to use your content for any purpose, including training their AI models and allowing other companies to use it, all without compensation. This means your creative work can be used to build commercial AI products that X or its partners profit from, without you seeing a dime.
Industry context: While broad content licenses are standard for social media, explicitly stating use for 'training machine learning and artificial intelligence models' and making it available to 'other companies, organizations or individuals' for 'their own independent purposes' without compensation is a more aggressive and less user-friendly stance than many competitors.
Waiver of Class Action Rights & Shortened Statute of Limitations
You give up your right to join a class-action lawsuit, forcing you to pursue any claims individually. Additionally, you have a severely limited time (1-2 years) to file any legal claims against X, which is much shorter than standard legal deadlines. These clauses significantly restrict your ability to seek justice or compensation if X wrongs you.
Industry context: Class action waivers are common among large tech companies but are always a high risk for users. The 1-2 year statute of limitations is unusually short and significantly worse than industry norms, which typically align with state/federal laws (often 3-6 years).
Mandatory Jurisdiction in Tarrant County, Texas (for non-EU/UK/EFTA users)
If you live outside the EU, UK, or EFTA, any legal dispute with X must be filed and heard exclusively in Tarrant County, Texas. For a global platform, forcing users worldwide to a specific county court in Texas creates an immense logistical and financial barrier to accessing justice.
Industry context: While many global companies specify a US state (e.g., Delaware or California), mandating a specific *county* for a global user base is an extreme and highly restrictive practice, far worse than industry norms.
X's Terms of Service and Privacy Policy are heavily skewed in the company's favor. They collect a vast amount of data, including potentially sensitive biometrics and installed apps, and reserve broad rights to use your content for AI training and third-party purposes without compensation. Furthermore, the legal terms are highly restrictive, limiting your ability to sue, shortening your time to do so, and forcing you into a specific, potentially inconvenient, jurisdiction. While the account deletion process is clear, be aware that some data may be retained for extended periods, and public content can persist elsewhere. Always review your privacy settings on the platform and consider the implications of what you post. For specific legal concerns, consult a qualified attorney.
Want to analyze a different service? Analyze any TOS →