X

X tracks you across the internet even when signed out, infers your identity from hashed email fragments and device signals, collects your address book, and reserves the right to collect biometric data with consent.

X's most alarming sharing practice is unique: third-party 'collaborators' can receive your data and use it for their own purposes — including training AI models — unless you opt out. Public posts are available via API for mass scraping at scale.

The AI training data-sharing opt-out is buried and non-default. Cookie data persists for 13 months. Deleted accounts can't be fully purged for 30 days, and public content lives on in third-party caches indefinitely.

Security described only as generic 'safeguards' with no certifications. Suspended account identifiers kept indefinitely. Policy changes are self-assessed for materiality. AI training use of data has no opt-out at the system level.