X’s New Privacy Risks: What Changed and How to Protect Your Account

A coalition of privacy advocacy groups has filed a formal warning with the Federal Trade Commission (FTC) about changes at X (formerly Twitter) that they say pose a “serious risk to Americans’ privacy.” The warning, reported by Ars Technica, follows a series of policy and feature updates under the platform’s current ownership. While the FTC has not yet announced an investigation, the filing puts the agency on notice—and gives millions of X users reason to review their account settings right now.

What Changed?

According to the advocates’ filing, two specific changes are at the heart of the concern:

  1. Default opt-in for data sharing with third parties. X has reportedly switched some user accounts to automatically share data with unnamed third-party partners, unless a user manually opts out. This is a reversal from the previous default, which required explicit consent.

  2. Expanded use of user content for AI training. X now appears to include all public posts—including those from users who have not explicitly opted in—in datasets used to train large language models and other artificial intelligence systems. This practice is similar to moves by other social media companies, but the advocates argue X’s opt-out mechanism is buried in settings and often unclear.

These changes are not subtle technical tweaks. They represent a meaningful shift in how the platform treats user data—from something users control to something the platform uses by default, unless the user takes specific steps to prevent it.

Why It Matters

The real-world risks are straightforward, if unsettling. With third-party data sharing turned on by default, your activity on X—the accounts you follow, the posts you like, the links you click, your location if you’ve ever added it—could be passed to companies you’ve never heard of. That data can be used for ad targeting, profile building, or sold further downstream.

When it comes to AI training, your public posts become raw material for a machine learning model. This includes not only your own text, but any images or links you’ve shared. Even if you’ve never agreed to any AI-related terms, the platform may consider your public activity fair game. The advocates’ concern is that users are not meaningfully informed, and the opt-out process is designed to discourage participation.

These practices are not unique to X—similar issues exist on Meta and TikTok. But the speed and opacity of X’s changes have made it a new flashpoint for privacy regulators.

What You Can Do Right Now

You don’t need to delete your account to reduce your exposure. Here are concrete steps, listed in order of importance:

  1. Review your data sharing and privacy settings.
    Go to Settings and Privacy > Privacy and Safety > Data Sharing and Personalization (or the equivalent menu on mobile). Look for any option labeled “Allow third-party data sharing,” “Share data with business partners,” or similar. If it’s turned on, turn it off. Do the same for “Personalization based on your inferred identity” and “Ads personalization.”

  2. Opt out of AI training.
    Under the same privacy menu, look for “Data sharing for AI training” or “Use of your posts for machine learning.” This setting may be labeled differently depending on your region and app version. Disable it. Note that even after opting out, previous public posts may already have been used.

  3. Make your account private.
    Switching your account to protected (private) limits your posts to approved followers only. This blocks third parties from scraping your content. Go to Settings and Privacy > Privacy and Safety > Audience and Tagging and check “Protect your posts.”

  4. Enable two-factor authentication (2FA).
    This won’t stop data sharing, but it does prevent account takeover, which is a growing problem. Use an authenticator app rather than SMS, which is less secure. Set it up under Settings and Privacy > Security and Account Access > Two-Factor Authentication.

  5. Delete old data you don’t need.
    X lets you download your archive and also delete posts, likes, and direct messages in bulk. Consider using the “Deactivate your account” option (which can be reversed within 30 days) if you want to pause your activity while still keeping the account.

  6. Consider alternatives.
    If you find you can no longer trust the platform’s privacy posture, you can move to services like Mastodon or Bluesky, which offer more user control. This is a bigger step, but for many people it may be the only way to stop data collection entirely.

What the FTC Could Do

The FTC’s role is to enforce rules against unfair or deceptive practices. If it decides to investigate, it could demand that X change its default settings, add clearer notices, or pay fines. That process can take months or years. In the meantime, individual users bear the responsibility for protecting their own data—a situation the advocates argue is itself a failure of regulation.

Sources

  • Ars Technica, “Musk’s X poses ‘serious risk to Americans’ privacy,’ advocates warn FTC,” July 2, 2026.
  • Coalition filing with the FTC (as referenced in the Ars Technica report).