Segment is a customer data platform (CDP) acquired by Twilio Inc. (NYSE: TWLO) in November 2020 for a total purchase price of $3.0 billion (estimated transaction value $3.2 billion). The product is designed to collect first-party event data from websites, mobile apps, and servers via SDKs such as analytics.js, unify it into per-user profiles keyed to a userId and traits like email and name, and route it to downstream "destinations" — over 300 analytics, marketing, and advertising tools. Segment generally operates as a data processor acting on its business customers' instructions, and Twilio's umbrella privacy notice governs controller-side processing. The platform ships privacy tooling, including a Privacy Portal that detects and classifies PII and a deletion/suppression API aligned to GDPR and CCPA requests, though Segment states it cannot guarantee deletion from downstream destinations. Parent company Twilio disclosed a 2022 smishing-driven breach affecting 163 customers and 93 Authy users, and a 2024 Authy endpoint incident exposing account phone numbers; no Segment-product-specific breach was identified. Twilio concluded an operational review of the Segment business in March 2024.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
[2023-06-06] · COLLECTION
Segment provides a Privacy Portal that scans incoming data from web, mobile, server, and cloud sources to automatically detect and classify PII (pre-classified Red/Yellow/Green by restriction level) and build a data inventory — a documented, product-level data-minimization control.
Twilio's FY2023 annual report describes Segment as a customer data platform whose function is collecting first-party data from customers' interactions with websites, mobile apps, and digital ads, and unifying that real-time information into a unique profile for each end customer.
Segment's Identify specification ties each end user to a persistent unique User ID plus identity traits such as email and name, which its SDKs record alongside the user's actions; the documented example payload includes a real name, email address, plan, and login count.
Twilio Inc. (NYSE: TWLO) completed its acquisition of Segment.io, Inc. on November 2, 2020, under a merger agreement dated October 12, 2020, disclosed in an SEC Form 8-K; Segment has operated as part of publicly traded Twilio since.
Twilio's FY2020 annual report discloses the Segment purchase price precisely: $3.0 billion total ($2.5 billion in Class A stock plus cash), with an estimated transaction value of $3.2 billion including assumed equity awards subject to vesting — a fully SEC-documented ownership trail.
Twilio conducted an operational review of its Segment business in 2023–2024 that left Segment's strategic future publicly uncertain for months; on March 5, 2024 Twilio announced the review's results with fiscal 2024–2025 financial targets, with Segment remaining a Twilio business unit.
Twilio's privacy notice states that for customer-directed services like Segment, Twilio acts as a data processor handling personal data under customer instructions and its Data Protection Addendum — meaning Segment pipes end-user data to third parties at its business customers' direction rather than selling it on its own account.
Segment documents that once data has been fanned out, it cannot guarantee deletion from downstream destinations: deletion requests are forwarded only to supported streaming destinations (such as Braze, Intercom, and Amplitude), and customers must confirm fulfillment or contact unsupported destinations themselves. Deletion requests carry a 30-day SLA capped at 100,000 users per 30 days.
Routing user data outward is Segment's core function: its documentation markets integrating website and mobile-app data into more than 300 downstream analytics and growth tools, and the analytics.js docs describe configurations for triggering ad network conversion pixels through the SDK.
Segment's parent company Twilio suffered an August 2022 SMS-phishing (smishing) attack on employees that gave attackers access to internal systems; Twilio's final investigation update reported unauthorized access to data of 163 Twilio customers and unauthorized device registrations on 93 Authy 2FA accounts. This was a Twilio corporate incident, not a Segment-product breach; Twilio published a detailed public post-mortem.
In July 2024, parent company Twilio confirmed that threat actors exploited an unauthenticated API endpoint to identify phone numbers associated with accounts of its Authy 2FA app, after a hacker group claimed to have obtained 33 million phone numbers; Twilio said it secured the endpoint. This incident is attributed to Twilio, separately from Segment's product-specific record, for which no comparable breach was found.
Twilio's umbrella privacy notice, which segment.com's privacy page redirects to, states that Twilio uses identity resolution to build unified cross-device profiles and deploys online tracking technologies, subject to user preferences.
Segment's analytics.js web SDK assigns every visitor a persistent anonymousId (stored in localStorage and cookies) and attaches it to all Page and Track events before and after login, automatically collecting url, title, referrer, and path on page calls; its Alias method merges previously unassociated user identities for destinations such as Kissmetrics and Mixpanel.
W3Techs' daily-updated survey measures Segment as the traffic-analysis technology on 0.1% of all websites, indicating meaningful but not ubiquitous deployment of its tracking SDK across the web.