Skip to main content

Additional information about data processing

This supplements the X Privacy Policy to provide additional information about the types of data we collect, where we get it, and how we process and share it.
 

Data processing summary
 

The table below contains a list of the general purposes for which we process personal data. For data from the European Union, EFTA States, and the United Kingdom, the third column in the table below contains the primary legal bases we rely on for such processing. 

Some processing activities may be accounted for in multiple rows if the processing or data involved is sufficiently distinct. For example, advertising revenues allow us to support and improve our services. To provide this advertising we process some of your data, and for data from the European Union, EFTA States, and the United Kingdom we rely on legitimate interests as the legal basis for doing so. We also offer you the ability to further personalize the ads you see based on data we receive about you from our advertising partners. If you are located in the European Union, an EFTA State, or the United Kingdom, we rely on consent as our legal basis for processing your data to provide these ads.

Processing purpose

Data

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Processing purpose

Operating our services, including:

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Contact information
  • Direct Messages and other non-public communications
  • Payment information
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from advertisers and other ad partners
  • Developer data
  • Data from other third parties and affiliates

Inferences about you, as described below, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Contractual necessity

Processing purpose

Safety and security features, including authentication, anti-spam, fraud protection, and quality and abuse prevention

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Contact information
  • Direct Messages and other non-public communications
  • Payment information
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from ad partners
  • Developer data
  • Data from other third parties and affiliates

Inferences about you, as described below, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Contractual necessity

Processing purpose

Inferences about your account - such as interests, age, and gender - which we use to provide features including:

You can always review and modify these inferences by visiting Your X data.

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Contact information
  • Non-public communications (survey data and accounts you correspond with by Direct Message)
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from ad partners
  • Data from other third parties and affiliates


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Legitimate interests

Processing purpose

Advertising we show you on X based on data you provide or we collect on X

Advertising we show you on other websites or mobile applications based only on information collected there

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Contact information
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from ad partners
  • Data from other third parties and affiliates

Inferences about you, as described above, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Legitimate interests

Processing purpose

Measuring the effectiveness of advertising we show you

Data

Information you share with us, including:

  • Basic account information

  • Public information

  • Account controls

  • Non-public communications (survey data)

Additional information we receive about you, including:

  • Location information

  • Interactions with links

  • Cookie data †

  • Log data

  • Data from ad partners

  • Data from other third parties and affiliates

Inferences about you, as described above, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Legitimate interests❖

Processing purpose

Exclusion audiences: enabling advertisers to exclude an advertiser-submitted audience from being eligible for an advertising campaign

Data

Information you share with us, including:

  • Basic account information

  • Public information

  • Contact information

  • Account controls

Additional information we receive about you, including:

  • Interactions with links

  • Cookie data †

  • Log data

  • Data from ad partners
  • Data from other third parties and affiliates


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Legitimate interests

Processing purpose

Personalized advertising: advertising we show you on and off X based on information we collect from you on X, your other activity online, and data from our partners

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Contact information
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from ad partners
  • Data from other third parties and affiliates

Inferences about you, as described above, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

Personalize based on your inferred identity

Data

Information you share with us, including:

  • Basic account information
  • Contact information
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from ad partners
  • Data from other third parties and affiliates


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

Personalizing our services based on the places you've been

Data

Additional information we receive about you, including:

  • Location information
  • Account controls

Inferences about you, as described above, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

Complying with legal requests

Data

As required by applicable law, regulation, legal process, or governmental request.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Legal obligation

Processing purpose

Additional information sharing with business partners

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Account controls
  • Non-public communications (survey data)

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from ad partners
  • Data from other third parties and affiliates

Devices we infer belong to you

Inferences about you, as described above, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent


Legitimate Interests (only for some Log data collected prior to X account sign up)

Processing purpose

Sharing data with third-party web clients or applications you've authorized

Data

Information you share with us, dependent on the permissions requested by the application or web client, including:

  • Basic account information
  • Public information
  • Contact information
  • Direct Messages and other non-public communications
  • Account controls


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

Sharing data with our service providers

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Contact information
  • Direct Messages and other non-public communications
  • Payment information
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from ad partners
  • Developer data
  • Data from other third parties and affiliates

Inferences about you, as described above, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Determined by the legal bases set forth in this table (contractual necessity, legitimate interests, consent, or legal obligation) for the processing activities for which the service provider is retained.

Processing purpose

Enabling others to find your account by your email address or phone number

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Account controls

Additional information we receive about you, including:

  • Data from third parties

Information we process with your consent, including:


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

Non-service related notifications about your X activity, related content, Direct Messages, and other X product features

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Contact information
  • Direct Messages and other non-public communications
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data

Inferences about you, as described above, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Legitimate interests

Processing purpose

Non-service related notifications about our X business products and third-party services

Data

Information you share with us, including:

  • Basic account information
  • Public information
  • Contact information
  • Non-public communications (between you and X)
  • Payment information
  • Account controls

Additional information we receive about you, including:

  • Location information
  • Interactions with links
  • Cookie data † 
  • Log data
  • Data from ad partners
  • Developer data


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

The processing activities described above:

  • Operating our services
  • Safety and security
  • Inferences
  • Personalized advertising
  • Measuring the effectiveness of advertising we show you
  • Sharing data with our service providers

Data

Information we process with your consent, including:

X for web data*

Devices we infer belong to you

Inferences about you, as described above, based on this data.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

The processing activities described above:

  • Advertising we show you on X based on data you provide or we collect on X

  • Advertising we show you on other websites or mobile applications based only on information collected there

  • Personalize based on your inferred identity

  • Personalizing our services based on the places you’ve been

Non-service related notifications about your X activity, related content, Direct Messages, and other X product features

Data

Information we process with your consent, including:

Inferences about you, as described above, based on this data.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

Additional personalization of our services based on where you see X content across the web

Additionally, the processing activities described above:

Non-service related notifications about your X activity, related content, Direct Messages, and other X product features

Data

Information you share with us, including:

  • Account controls

X for web data*

Devices we infer belong to you

Inferences about you, as described above, based on this data.


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

Processing purpose

Identify verification for safety & security, general verification, and fraud and payment manipulation purposes

Data

What we collect: 
Image of your ID, selfie, which includes face biometric data, and data from your ID.

How long do we store:
Data extracted from the ID, image of your ID, and the selfie may be kept for 30 days for optional X Premium and Safety and Security purposes, including impersonation. This provides you an opportunity to appeal a verification decision and for X to review your appeal.

Data extracted from the ID, image of your ID, and the selfie may be kept for 30 days in connection with identity verification for the Creator Subscriptions or Ads Revenue Share programs. The full name, address extracted from the ID, when possible, and hashed government ID number for identity verification for these programs will be stored by X for as long as you participate in the programs to help protect users from fraud and payment manipulation. 

Who stores the data & who we share with:
X does not directly store this data in connection with the optional X Premium and Safety and Security purposes, including impersonation. X directly stores the full name, a hash of the document ID number and address extracted from the ID in connection with identity verification for the Creator Subscriptions or Ads Revenue Share programs. In all use cases, X shares the data with Au10tix, who acts as our data processor. Au10tix processes and stores the data as detailed above.

Primary legal basis/bases for processing personal data from the EU, EFTA States, and UK

Consent

* We do not collect X for Web data from browsers that we believe to be located in the European Union or the European Economic Area.

† We set and use cookies as described in Our use of cookies and similar technologies, and if you are in the European Union, an EFTA State, or the United Kingdom with your consent as provided for under Directive 95/46/EC.

❖X also shares non-public personal information with advertisers that are not acting as data processors in order to enable those advertisers to measure their own advertising. As described above, X treats such partnerships as consent-based data processing and X customers located in the European Union, an EFTA state, or the United Kingdom must have their  “Allow additional information sharing with business partners” setting enabled in order for X and its data processors to share their non-public personal information with non-data-processors in such circumstances.

 

Legitimate interests analysis summary – inferences about your account
 

X uses information that individuals provide and data that it receives (as described in X’s Privacy Policy) to make inferences about the people who use X and content on the platform. This includes inferences like what topics people may be interested in, how old a person is, what languages a person speaks, and whether the content of one account may be of interest to others on the platform. This helps X offer better services and personalize the content X shows, including ads.

Without these inferences, people would have a harder time finding content that interested them, X would have a more difficult time keeping the platform safe and enjoyable for everyone, and X’s advertising would be less compelling to those who saw it and less valuable to X’s business customers.

To safeguard the rights of those who use our services, if an individual wishes to review and modify information that X has inferred about them, that individual may do so by using Your X data. This service is available both to individuals with a X account and those who do not have an account or are logged out of X. 
 

Legitimate interests analysis summary – advertising we show you on X based on data you provide or we collect on X, or on other websites or mobile apps based on information collected there
 

X uses information that individuals provide and data that it receives during the individual’s use of X (as described in X’s Privacy Policy) to improve the quality of the ads the individual sees on the platform. When X shows ads in other apps or websites, X uses information from that app or website to improve the quality of the ads the individual sees.

This enables X to give individuals a better product experience that is more in line with their interests and the content they find most meaningful and relevant to them, and to provide more valuable advertising offerings that generate revenue to support and improve its services. Without this processing, X’s advertising would be less compelling to those who saw it and less valuable to X’s business customers.

To safeguard the rights of those who use our services, X offers individuals a variety of controls over the ads they see on X.  Individuals may block or mute specific advertisers if they do not wish to see ads from those advertisers, report bad or offensive ads, and flag ads that they do not like. In addition, every ad on X provides a dropdown “Why am I seeing this ad?” option to let the individual see the basis on which the ad was shown to them, such as inferred age, gender, and interests. The individual may then modify that information in Your X data to affect future ads that they see. This service is available both to individuals with a X account and those who do not have an account or are logged out of X.
 

Legitimate interests analysis summary – Measuring the effectiveness of advertising we show you
 

X uses information that individuals provide and data that it receives (as described in X’s Privacy Policy) to measure the effectiveness of the advertising X shows to individuals. 

This enables X to give advertisers a means of better understanding the performance of the advertising they purchase through X. Such advertising measurement offerings are a critical component of X’s business because they enable advertisers to make informed decisions about what kinds of advertisements they should run, when they should run them, what kinds of content they should include, and the audiences they should try to reach. Without this processing, X’s advertising would be less compelling to those who saw it and less valuable to X’s business customers.

To safeguard the rights of those who use our services, X primarily offers advertising measurement through data processor partnerships that generate reports for advertisers about key performance indicators of their X advertising campaigns. These data processors are subject to a number of contractual restrictions around how they are permitted to process data received from X, including that they are prohibited from sharing with third parties that are not acting as data processors any X data that by itself can be used to identify an individual. 

X also shares non-public personal information with advertisers that are not acting as data processors in order to enable those advertisers to measure their own advertising. As described above, X treats such partnerships as consent-based data processing and X customers located in the European Union, an EFTA state, or the United Kingdom must have their  “Allow additional information sharing with business partners” setting enabled in order for X and its data processors to share their non-public personal information with non-data-processors in such circumstances.
 

Legitimate interests analysis summary – enabling advertisers to exclude an advertiser-submitted audience from being eligible for an advertising campaign
 

X uses information that individuals provide and data that it receives (as described in X’s Privacy Policy) to enable advertisers to exclude an advertiser-submitted audience from being eligible for an advertising campaign. 

This enables X to give advertisers a way to avoid showing their ads to people who are irrelevant to the goals of their campaigns (e.g., people who have already installed the advertiser’s game). This feature is a critical component of X’s business because it helps X serve fewer irrelevant ads and enables X advertisers to effectively run advertising campaigns at scale while reducing bad user experiences with irrelevant ads and wasting money serving ads to users who have already taken the action being advertised. Without this processing, X’s advertising would be less compelling to those who saw it and less valuable to X’s business customers, some of whom would not run advertising campaigns on X at all.

To safeguard the rights of those who use our services, X implements technical measures, contracts, and policies to disclose this processing, separate out the personal data processed only for this purpose, minimize the amount and type of personal data processed for this purpose, and avoid processing of personal data based on categories that may be sensitive or are prohibited by law, such as race, religion, politics, sex life, or health.
 

Legitimate interests analysis summary – non-service related notifications about your X activity, related content, Direct Messages, and other X product features
 

X uses information that individuals provide and data that it receives (as described in X’s Privacy Policy) to send non-service related notifications to X account holders about their X activity, related content, Direct Messages, and other X product features. This enables X to provide information that individuals may find valuable or useful, such as posts or Direct Messages directed to the individual, analytics about content the individual authored, and new product features.

Without these notifications, people would have a harder time learning of content relevant to them on X, would receive less feedback about their content on X, and would potentially miss out on conversations with others on X.

To safeguard the rights of those who use our services, each non-service related email notification contains an opt out link that enables the individual to disable any or all such notifications. An individual can similarly update his or her preferences at any time while logged into X.com or our mobile apps. For individuals in the European Union, an EFTA State, and the United Kingdom, control is also provided during the registration process in which the individual’s email address is first collected.
 

Legitimate interests analysis summary –  processing public post data to train machine learning and artificial intelligence models, including generative models

X may use information that individuals provide and data that it receives (as described in X’s Privacy Policy) to train machine learning and artificial intelligence models, including generative models. This includes public X posts and associated metadata of X users. This helps X offer better services, including summaries of search results and content.

Without this training and processing, people would not have access to a large range of information, opinions, viewpoints and accurate summaries and X would have a more difficult time providing relevant, accurate and appropriate responses.

To safeguard the rights of those who use our services, users can easily “protect” (limit to a followers-only audience) their posts, or delete their posts at any time, thereby removing their posts and related metadata from being used. X also provides information and user controls to enable X users to opt out of their public post data being used to train an underlying generative model.
 

Sources of personal data we process
 

The table below describes the categories of sources from which we may receive personal data. 

Data Category

Data

Source(s)

Data Category

Online Activity

(Internet and other electronic network activity information, including, but not limited to, information regarding interactions with websites, applications, or advertisements)

 

Data

  • Information you post on X 

  • Direct Messages and other non-public communications

  • Account controls

  • Interactions with links

  • Cookie data

  • Log data

  • Data from advertisers and other ad partners
  • Developer data
  • Data from other third parties and affiliates

 

For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Source(s)

  • You or your devices, for example, through your use of our services and third-party services 

  • Other people on X, through their use of our services, such as by tagging you in a photo (if your settings allow), mentioning you in a post, or sending you Direct Messages

  • Third-party services that integrate X content, such as embedded timelines or post buttons

  • Our corporate affiliates

  • Vendors who provide services on our behalf, such as our subprocessors

  • Advertisers and other ad partners

Data Category

Payment Information

Data

  • Credit or debit card number

  • Card expiration date
  • CVV code
  • Billing address

 

For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Source(s)

  • You, if you purchase advertising services from us

Data Category

Identifiers

(Real name, alias, postal address, telephone numbers, unique identifiers (such as a device identifier, cookies, mobile ad identifiers), customer number, Internet Protocol address, email address, account name, and other similar identifiers)

 

Data

  • Basic account information

  • Information you post on X 

  • Developer data

  • Contact information

  • Address book data

  • Devices we infer belong to you

  • Cookie data

  • Log data

  • Data from advertisers and other ad partners
  • Data from other third parties and affiliates

 

For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Source(s)

Data Category

Protected Classifications

(Characteristics of certain legally protected classifications, such as age range and gender)

Data

  • Information you post on X 
  • Inferences about your account, as listed below
     

For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

 

Source(s)

  • You or your devices, for example, through your use of our services or third-party services

  • Other people on X, through their use of our services, such as by tagging you in a photo (if your settings allow), mentioning you in a post, or sending you Direct Messages

  • Third-party services that integrate X content, such as embedded timelines or post buttons

  • Our corporate affiliates

  • Vendors who provide services on our behalf

  • Advertisers and other ad partners

Data Category

Commercial Information

(Records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies)

 

Data

  • Information you post on X 

  • Interactions with links

  • Cookie data

  • Log data

  • Data from advertisers and other ad partners

  • Developer data

 

For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

 

Source(s)

Data Category

Sensory Information

(Audio, electronic, visual, and similar information)

Data

  • Information you post on X 
  • Direct Messages and other non-public communications

 

For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Source(s)

  • You or your devices, for example, through your use of our services 

  • Other people on X, through their use of our services, such as by tagging you in a photo (if your settings allow), mentioning you in a post, or sending you Direct Messages or protected posts

Data Category

Location Data

Data

 

For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Source(s)

  • You or your devices, for example, through your use of our services

Data Category

Inferences

(Inferences drawn to create a profile about you reflecting your preferences, characteristics, predispositions, behavior, and attitudes)

 

Data


For details regarding information we collect when you use X, please refer to Section 1 ("Information We Collect") of our Privacy Policy.

Source(s)

  • You or your devices, for example, through your use of our services or third-party services

  • Other people on X, through their use of our services, such as by tagging you in a photo (if your settings allow), mentioning you in a post, or sending you Direct Messages

  • Third-party services that integrate X content, such as embedded timelines or post buttons

  • Our corporate affiliates

  • Vendors who provide services on our behalf

  • Advertisers and other ad partners

     


Categories of third parties with whom we may share personal data 
 

The table below describes the categories of third parties with whom we may share certain personal data from the listed data categories. For details regarding how we share personal data, including the purposes for which we share it, please refer to Section 3 ("Sharing Information") of our Privacy Policy. 

Data Category

We may share with...

Data Category

Online Activity

Identifiers

Protected Classifications

Commercial Information

Sensory Information

We may share with...

  • Entities with whom you direct us to share your information, such as when you post publicly 

  • Entities you provide access to your account, such as third-party web clients or applications you authorize

  • Our corporate affiliates

  • Our business partners and our service providers, including advertisers and other ad partners

  • Law enforcement and others as necessary to comply with law, prevent harm, and serve the public interest


For details regarding the ways we share your information, why we share it, and how you can control it when you use X, please refer to Section 3 ("Sharing Information") of our Privacy Policy.

Data Category

Payment Information

We may share with...

  • Our service providers


For details regarding the ways we share your information, why we share it, and how you can control it when you use X, please refer to Section 3 ("Sharing Information") of our Privacy Policy.

Data Category

Location Data

We may share with...

  • Our service providers

  • Law enforcement and others as necessary to comply with law, prevent harm, and serve the public interest


For details regarding the ways we share your information, why we share it, and how you can control it when you use X, please refer to Section 3 ("Sharing Information") of our Privacy Policy.

Data Category

Inferences

We may share with...

  • Our corporate affiliates

  • Our business partners and our service providers, including advertisers and other ad partners

  • Law enforcement and others as necessary to comply with law, prevent harm, and serve the public interest


For details regarding the ways we share your information, why we share it, and how you can control it when you use X, please refer to Section 3 ("Sharing Information") of our Privacy Policy.

Share this article