X Corp.'s own privacy policy and related disclosures show that the company collects data not only directly from users but also from advertising partners, ingesting cookie IDs, device identifiers, and hashed contact data that can be combined with existing user profiles. The company enables advertisers to embed X's tracking technology on third-party sites and shares non-public personal information for ad measurement, with EU/EFTA/UK users given only an opt-in toggle. A 2024 policy change and 2026 terms update expand X's ability to share user data with third-party 'collaborators,' including AI developers, largely on an opt-out (or no-opt-out) basis. Corporate ownership has changed twice in two years, moving from Twitter to X Corp. under xAI (March 2025) and then to a more complex structure under SpaceX (February 2026), with reporting suggesting a new holding company structure that complicates public visibility into the ownership chain. The company's regulatory track record includes a 2011 FTC consent order, a 2022 FTC/DOJ settlement with a $150 million penalty for misusing security data for advertising, a 2020 Irish DPC fine for GDPR breach-notification failures, and a large-scale 2023 data exposure affecting ~200 million accounts. In 2026, X Corp. petitioned the FTC to set aside or modify its 2022 settlement order, and the FTC opened a public comment period on that petition.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2026-06-04]
FTC Chair Lina Khan stated at the time of the 2022 settlement that Twitter obtained security data from users under false pretenses and then also used it to target advertising.
In 2022, the FTC and Department of Justice reached a settlement with Twitter, imposing a $150 million civil penalty and requiring a comprehensive privacy and information security program, after alleging the company used phone numbers and emails collected for account security for targeted advertising.
X's Privacy Policy (effective January 15, 2026, naming X Corp. as the data controller for users outside the EU/EFTA/UK) states that X collects device information including "Information about your device and its settings, such as device and advertising ID, operating system, carrier, language, memory, apps installed, and battery level," as well as approximate location information "to provide the service you expect, including showing you relevant ads."
As of March 2025, X (formerly Twitter) became a wholly owned subsidiary following an all-stock transaction in which Elon Musk's xAI acquired the company.
Corporate filings referenced in tax/finance analysis indicate the February 2026 SpaceX-xAI merger likely produced a new holding structure ("xAI Holdco") with X's operating entity nested beneath it, complicating a simple public view of the ownership chain.
In October 2024, X added a "Third-party collaborators" provision to its Privacy Policy stating that, depending on settings or unless a user opts out, recipients of shared information may use it for their own independent purposes, including training artificial intelligence models.
In 2022, the FTC and Department of Justice reached a settlement with Twitter, imposing a $150 million civil penalty and requiring a comprehensive privacy and information security program, after alleging the company used phone numbers and emails collected for account security for targeted advertising.
FTC Chair Lina Khan stated at the time of the 2022 settlement that Twitter obtained security data from users under false pretenses and then also used it to target advertising.
X's Privacy Policy states: "Like many websites, we use cookies and similar technologies to collect additional website usage data and to operate our services," and its retention disclosures add that X generally collects device, location, inferred identity, and log information using cookies and keeps cookies and cookie-collected information for up to 13 months.