Dropbox

PRODUCTIVITY & CLOUD

LAST UPDATED 27 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Dropbox's own privacy policy (effective May 30, 2025) discloses broad collection of account details and file-associated metadata ('Your Stuff'), and separately discloses that its Dash feature imports browser history for search functionality, with sharing of that data to 'trusted third parties.' The company states on its trust pages that it does not sell personal data to advertisers, and its corporate structure is disclosed via SEC public-company filings (NASDAQ: DBX) and a two-entity controller model for North American versus international users; its track record includes a 2011 FTC complaint over encryption representations, a 2012 credential breach affecting roughly 68 million accounts (disclosed publicly in 2016), and a 2022 phishing-driven breach of internal GitHub code repositories.

TRACK RECORD

1 BREACH

[2012-07-01] · BREACH

Have I Been Pwned lists a breach record for Dropbox: "Dropbox".

Approximately 68,648,009 accounts affected, per HIBP.

Exposed: Email addresses, Passwords.

haveibeenpwned.com ↗

Breach data: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

23 ON FILE

[2020-12-15] · COLLECTION

The service's policy indicates you can request access, correction and/or deletion of your data.

help.dropbox.com ↗

[2021-03-28] · COLLECTION

As assessed by PrivacySpy on 2021-03-28 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service allow you to permanently delete your personal data? — Yes, using an automated mechanism.

privacyspy.org ↗

[2025-05-30] · COLLECTION

Dropbox's privacy policy states it collects account information such as name, email address, phone number, payment information, and physical address, plus data associated with files and activity referred to as 'Your Stuff.'

dropbox.com ↗

[2025-06-30] · COLLECTION

Dropbox's help center discloses that when a user enables the Dash feature, Dropbox imports the user's browser history going back 90 days, including URLs visited and the contents of those pages (titles, images, and page content), to power search across open tabs.

help.dropbox.com ↗

[2026-03-30] · COLLECTION

The service's policy indicates your personal data may be sold unless you opt out.

help.dropbox.com ↗

OWNERSHIP TRANSPARENCY

Dropbox's privacy and data protection whitepaper discloses that Dropbox, Inc. acts as the service provider for North American users, while Dropbox International Unlimited Company acts as the data controller for users located elsewhere.

assets.dropbox.com ↗

OWNERSHIP TRANSPARENCY

The service's policy indicates you maintain ownership of your content.

dropbox.com ↗

[2021-03-28] · OWNERSHIP TRANSPARENCY

As assessed by PrivacySpy on 2021-03-28 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.

privacyspy.org ↗

SHARING

Dropbox's business trust page states that the company does not sell user data or information to advertisers or other third parties.

dropbox.com ↗

[2020-12-15] · SHARING

The service's policy indicates many third parties are involved in operating the service.

help.dropbox.com ↗

[2021-03-28] · SHARING

As assessed by PrivacySpy on 2021-03-28 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.

privacyspy.org ↗

[2025-06-30] · SHARING

Dropbox's privacy policy FAQ discloses that data (including data collected via the Dash feature) may be shared with 'trusted third parties,' and separately lists infrastructure/service providers such as Amazon Web Services, Inc. as recipients of user information to perform tasks on Dropbox's behalf.

help.dropbox.com ↗

[2026-03-30] · SHARING

The service's policy indicates you cannot distribute or disclose your account to third parties.

dropbox.com ↗

[2026-03-30] · SHARING

The service's policy indicates first-party cookies are used.

help.dropbox.com ↗

[2011-05-26] · TRACK RECORD

In May 2011, a complaint was filed with the U.S. Federal Trade Commission alleging that Dropbox made deceptive statements to consumers about the extent to which it encrypted and protected user data.

huntonprivacyblog.com ↗

[2011-07-22] · TRACK RECORD

In June 2011, a putative class action was filed in the U.S. District Court for the Northern District of California alleging Dropbox failed to secure user data and did not notify most users about a bug that allowed cross-account access to files.

huntonprivacyblog.com ↗

[2012-07-01] · TRACK RECORD

Have I Been Pwned's breach catalog lists the "Dropbox" incident (dropbox.com), breach date 2012-07-01, affecting approximately 68,648,009 accounts. Data classes exposed per HIBP: Email addresses, Passwords. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.

haveibeenpwned.com ↗

[2016-08-31] · TRACK RECORD

A 2012 Dropbox data breach that compromised email addresses and hashed passwords for over 68 million accounts was not disclosed to the public with its full scope until 2016, when the stolen dataset surfaced and Dropbox confirmed its authenticity.

nbcnews.com ↗

[2021-03-28] · TRACK RECORD

As assessed by PrivacySpy on 2021-03-28 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, within 72 hours.

privacyspy.org ↗

[2022-11-03] · TRACK RECORD

In November 2022, Dropbox disclosed that a phishing campaign impersonating CircleCI led to unauthorized access to 130 of its internal GitHub source code repositories, exposing API keys and several thousand names and email addresses of employees, customers, sales leads, and vendors, while stating core application code and customer content, passwords, and payment information were not affected.

thehackernews.com ↗

[2026-03-30] · TRACK RECORD

The service's policy indicates your account may be suspended and/or terminated for breaching the Terms of Service.

dropbox.com ↗

[2025-06-30] · TRACKING TECH

Dropbox's privacy policy FAQ discloses that the company may use hash-matching technology combined with human review to evaluate content for compliance with its Acceptable Use Policy.

help.dropbox.com ↗

[2026-03-30] · TRACKING TECH

The service's policy indicates tracking pixels are used in service-to-user communication.

help.dropbox.com ↗

DATA SOURCES

ToS;DR

CC BY-SA · TOSDR.ORG ↗

PrivacySpy

CC BY · PRIVACYSPY.ORG ↗

Have I Been Pwned (haveibeenpwned.com)

CC BY 4.0 · HAVEIBEENPWNED.COM ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-27 · METHODOLOGY v1.7