On Wednesday, the social network X (formerly Twitter) updated its Privacy Policy to allow third-party “collaborators” to use user data to train their AI models, unless users choose to opt out. This change comes after X owner Elon Musk trained the Grok AI chatbot using X user data, which led to an investigation by the EU’s privacy regulator. Until now, X hadn’t stated that third parties could also access this data.
The policy update suggests that X is exploring new revenue streams, similar to Reddit and other media organizations, by potentially licensing data to AI companies.
In the updated Privacy Policy, under the section titled “Sharing Information,” X added a paragraph explaining how user data may be shared and how users can opt out. It states:
“Third-party collaborators. Depending on your settings, or if you decide to share your data, we may share or disclose your information with third parties. If you do not opt out, in some instances the recipients of the information may use it for their own independent purposes in addition to those stated in X’s Privacy Policy, including, for example, to train their artificial intelligence models, whether generative or otherwise.”
While the policy directs users to their settings page, it does not specify where to disable data-sharing. Currently, the “Privacy and safety” section allows users to manage data-sharing with xAI’s Grok and other “business partners,” but it doesn’t mention AI providers specifically. This may be because the updated policy won’t take effect until November 15, when the opt-out option might be clarified.
Read Also: General Catalyst Secures $8 Billion in New Funding to Support Startups Worldwide.
Additionally, the company removed a paragraph stating that it keeps user profile information and content for the duration of an account, along with personally identifiable data for a maximum of 18 months. The new section indicates that X will retain different types of information for varying periods, depending on its needs to provide services, comply with legal requirements, and ensure safety. For example, usage data like posted content will be kept for the account’s duration or until the content is removed.
The policy also reminds users that public content can persist elsewhere even after being deleted from X, noting that “search engines and other third parties may retain copies of your posts longer, based upon their own privacy policies, even after they are deleted or expire on X.”
Separately, X has introduced a new “Liquidated Damages” section in its Terms of Service, stating that any organization scraping its content will face penalties. Specifically, if an organization accesses over 1,000,000 posts in a 24-hour period, they will be charged $15,000 per million posts.
This move to monetize X’s data comes as the company seeks new revenue sources due to advertiser withdrawals and a slow start for its subscription feature. X did not respond to requests for comment.
