X (Twitter)

SOCIAL & MESSAGING

LAST UPDATED 27 JUL 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

X (formerly Twitter), now operated by X Corp. under the xAI/X.AI Holdings corporate umbrella, discloses in its privacy policy that it collects a broad range of data including biometric information (with consent), employment/education history, device and ad-identifier data, and that it may share or transfer user data in corporate transactions. The platform's predecessor entity was fined $150 million by the FTC in 2022 for using security-related phone numbers and emails for advertising, has faced Irish Data Protection Commission intervention over training its Grok AI model on EU users' public posts, and has been linked to large-scale data leaks reported in 2023 and 2025. Its corporate ownership has changed rapidly — from Twitter, Inc. to X Corp. to a subsidiary of xAI and then, per 2026 reporting, into SpaceX's corporate structure — which is publicly reported but spread across multiple holding-company transactions.

TRACK RECORD

2 BREACHES · 1 ENFORCEMENT ACTION

BREACH LEDGER

[2022-01-01] · BREACH

Have I Been Pwned lists a breach record for X (Twitter): "Twitter".

Approximately 6,682,453 accounts affected, per HIBP.

Exposed: Bios, Email addresses, Geographic locations, Names, Phone numbers, Profile photos, Usernames.

haveibeenpwned.com ↗

[2021-01-01] · BREACH

Have I Been Pwned lists a breach record for X (Twitter): "Twitter (200M)".

Approximately 211,524,284 accounts affected, per HIBP.

Exposed: Email addresses, Names, Social media profiles, Usernames.

haveibeenpwned.com ↗

Breach data: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0

ENFORCEMENT

[2026-06-03]

In June 2026, the FTC opened a public comment period on a petition from X Corp. asking the agency to set aside or modify the 2022 privacy consent order, arguing the order was imposed on a company that 'no longer exists.'

ftc.gov ↗

TIMELINE

NO ENTRIES ON FILE YET.

ULTIMATE PARENT

TOOLS WE RECOMMEND

PLUS

RECEIPTS

14 ON FILE

[2023-08-31] · COLLECTION

X's privacy policy, effective September 29, 2023, states the company may collect and use biometric information for safety, security, and identification purposes based on user consent, applicable to X Premium identity verification.

cbsnews.com ↗

[2025-03-28] · OWNERSHIP TRANSPARENCY

On March 28, 2025, Elon Musk announced that xAI had acquired X (X Corp.) in an all-stock transaction valuing X at $33 billion and xAI at $80 billion, making X Corp. part of the combined xAI corporate structure.

cnbc.com ↗

[2026-02-03] · OWNERSHIP TRANSPARENCY

On February 2, 2026, SpaceX announced an all-stock acquisition of xAI (which owns X Corp.), valuing the combined entity at $1.25 trillion, further extending the corporate chain above X to SpaceX.

cnbc.com ↗

[2024-11-15] · SHARING

X's privacy policy states the company may share, sell, or transfer information about users in connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, with the policy continuing to apply to the transferred data.

twitter.com ↗

[2026-04-07] · SHARING

The service's policy indicates this service informs you that its Terms of Service does not apply to third-party services.

x.com ↗

[2026-06-04] · SHARING

The FTC's 2022 order alleged that Twitter obtained phone numbers and email addresses from users under the pretext of account security purposes and used that data for targeted advertising, generating advertising revenue from it.

therecord.media ↗

[2021-01-01] · TRACK RECORD

Have I Been Pwned's breach catalog lists the "Twitter (200M)" incident (twitter.com), breach date 2021-01-01, affecting approximately 211,524,284 accounts. Data classes exposed per HIBP: Email addresses, Names, Social media profiles, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.

haveibeenpwned.com ↗

[2022-01-01] · TRACK RECORD

Have I Been Pwned's breach catalog lists the "Twitter" incident (twitter.com), breach date 2022-01-01, affecting approximately 6,682,453 accounts. Data classes exposed per HIBP: Bios, Email addresses, Geographic locations, Names, Phone numbers, Profile photos, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.

haveibeenpwned.com ↗

[2023-01-05] · TRACK RECORD

In January 2023, a security researcher reported that a dataset containing over 200 million Twitter user email addresses had been posted for free on a hacking forum, tied to a vulnerability the company had previously acknowledged.

aljazeera.com ↗

[2025-04-01] · TRACK RECORD

In April 2025, a poster on a hacking forum released a dataset of over 201 million X user records, including emails, usernames, and profile metadata, which cybersecurity researchers at SafetyDetectives partly verified as authentic.

forbes.com ↗

[2026-04-07] · TRACK RECORD

The service's policy indicates your account may be suspended and/or terminated for breaching the Terms of Service.

x.com ↗

[2026-06-03] · TRACK RECORD

ftc.gov ↗

[2026-06-03] · TRACK RECORD

In 2022, the FTC ordered Twitter to pay a $150 million civil penalty and implement a comprehensive privacy and information security program after finding it violated a 2011 consent order by using phone numbers and emails collected for account security for advertising purposes.

finance.yahoo.com ↗

[2024-11-15] · TRACKING TECH

X's privacy policy states that ad and business partners share browser cookie IDs, X-generated identifiers, mobile device IDs, and hashed user information such as email addresses, which X may combine with other information it holds about the user.

twitter.com ↗

DATA SOURCES

ToS;DR

CC BY-SA · TOSDR.ORG ↗

Have I Been Pwned (haveibeenpwned.com)

CC BY 4.0 · HAVEIBEENPWNED.COM ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-07-27 · METHODOLOGY v1.7