EFF Writes to FTC: X Platform Allegedly Violates Privacy Consent Order, Raising Serious User Data Protection Concerns

A Formal Letter That Sparked Widespread Attention

The Electronic Frontier Foundation (EFF) recently submitted a formal letter to the U.S. Federal Trade Commission (FTC), raising serious concerns about whether X (formerly Twitter) has violated the privacy consent order it previously reached with the FTC. The letter quickly sparked heated discussion in the Hacker News community, becoming a focal point in the tech privacy space.

As one of the world's most influential digital rights advocacy organizations, EFF was founded in 1990 in San Francisco by Mitch Kapor, John Gilmore, and John Perry Barlow. Over more than three decades, EFF has continuously defended users' rights to free expression, privacy, and innovation in digital spaces through litigation, legislative lobbying, technology development (such as the Privacy Badger browser extension and HTTPS Everywhere), and public education. This unique position — combining legal expertise with broad public influence — gives its letters to the FTC strong signal value in the privacy community. This latest public action targeting X once again places the privacy compliance responsibilities of major social platforms squarely in the spotlight.

What Is an FTC Privacy Consent Order?

The Regulatory History from Twitter to X

To understand the legal weight of this letter, it helps to first understand the regulatory history between Twitter (now X) and the FTC. As far back as 2011, Twitter reached a settlement with the FTC over its failure to adequately protect users' personal information, signing a legally binding consent order that required it to establish a comprehensive information security program and submit to long-term third-party audits.

The historical background of the FTC consent order system is worth examining in depth. This mechanism originated in the early 20th century U.S. antitrust movement, initially used primarily to regulate commercial fraud. In the digital age, it has been widely applied to privacy enforcement. Beyond Twitter, Facebook (Meta) signed consent orders with the FTC in both 2012 and 2019 — the 2019 settlement resulted in a record $5 billion fine, the largest privacy penalty ever levied against a tech company in U.S. history. Google was fined $170 million in 2019 for COPPA violations related to children's privacy. These cases collectively reveal that consent orders have become the FTC's primary tool for regulating the privacy practices of major tech platforms — though their deterrent effect has been widely questioned in practice, as fines are often viewed as an acceptable "cost of doing business" relative to these platforms' annual revenues.

In May 2022, the FTC again fined Twitter $150 million — this time for using phone numbers and email addresses that users had provided for account security purposes (such as two-factor authentication) for targeted advertising. Two-factor authentication (2FA) is a security mechanism that requires users to provide a second form of verification beyond a password; when users provided their phone numbers, the platform explicitly stated the data would only be used for security verification. In practice, however, Twitter fed this data into its advertising targeting system for a "Custom Audiences" feature — advertisers would upload contact lists, the platform would perform hashed matching behind the scenes, enabling advertisers to reach specific user groups more precisely. This pattern of behavior is known as "purpose creep," and it starkly illustrates the systemic erosion of user trust inherent in platform business models. The new settlement further tightened constraints on the platform's data usage.

"Purpose creep" is not unique to Twitter — it is a structural byproduct of the platform economy. LinkedIn was found to have used user email addresses to send marketing messages to non-members; Zoom was revealed during the pandemic to have used video call data to train AI models; Venmo's default public friends list exposed sensitive social relationships. From a technical standpoint, the complexity of modern data pipelines makes tracking data flows extremely difficult, and architectures like "data warehouses" and "data lakes" naturally tend to consolidate data from different sources and intended uses — making regulatory granularity far harder to achieve than the technical reality demands.

Key Constraints in the Consent Order

An FTC Consent Order is a special legal instrument under the U.S. regulatory system that sits somewhere between an administrative settlement and a judicial ruling. Under Section 5 of the Federal Trade Commission Act, the FTC has the authority to investigate and seek remedies for "unfair or deceptive acts or practices." Consent orders are typically reached without the company admitting wrongdoing, but once signed they carry mandatory enforcement power — violations can result in civil penalties of hundreds of thousands of dollars per violation. Consent orders generally last 20 years, and critically: their binding force does not automatically dissolve when a company changes ownership. When Musk completed his acquisition, the existing compliance obligations theoretically carried over intact to the new entity — a key legal premise underlying EFF's letter.

FTC privacy consent orders typically include the following key requirements:

• Data use restrictions: Specific data provided by users may only be used for the agreed-upon purposes
• Privacy governance mechanisms: Companies must maintain systematic, auditable privacy protection programs
• Independent third-party audits: Regular external audits with reports submitted to the FTC
• Executive compliance certifications: Company executives must provide written attestations regarding compliance status

EFF's Core Concerns: X's Compliance Capacity in Question

Organizational Turmoil Following Musk's Acquisition

Since Musk completed his acquisition of Twitter in 2022 and rebranded it as X, the platform has undergone dramatic organizational restructuring. Sweeping layoffs hit core functions including privacy, security, and compliance, while multiple executives with data protection responsibilities departed — raising widespread questions about whether the platform can continue to fulfill its FTC consent order obligations.

From a compliance management perspective, the impact of this personnel upheaval runs far deeper than it appears on the surface. The mass layoffs at the end of 2022 eliminated roughly 80% of staff in security, privacy, and trust and safety teams, including multiple C-suite executives — the Chief Information Security Officer (CISO), Chief Privacy Officer (CPO), and Chief Compliance Officer (CCO) all departed. Notably, former CPO Damien Kieran and former CSO Lea Kissner publicly expressed concerns about the platform's compliance capacity after leaving. The FTC consent order requires companies to regularly submit compliance certifications signed by executives — when the executives whose signatures are required are no longer in their roles, the practical effectiveness of this mechanism becomes questionable. Ireland's Data Protection Commission (DPC), as the primary regulator for X's European operations, has also opened investigations into multiple data processing issues.

EFF's letter argues that given the severe reduction in specialized privacy teams and the instability in internal governance structures, X's actual capacity to fulfill the technical and procedural requirements of the consent order has been substantially diminished. Notably, the consent order explicitly requires companies to maintain systematic privacy governance mechanisms — and organizational continuity is a prerequisite for such mechanisms to function. When privacy compliance teams have largely disappeared, the authenticity and completeness of third-party audit reports themselves becomes a question worth asking.

Data Boundary Disputes from AI Strategy Expansion

As X aggressively pursues its AI strategy — particularly its deep integration with xAI — the boundaries around user data usage have grown increasingly murky. Grok is a large language model (LLM) developed by Musk's xAI company. LLM training is fundamentally a process of extracting statistical patterns from massive volumes of text; the scale, diversity, and recency of training data directly determines model performance. For this reason, social platforms with hundreds of millions of real-time user-generated content pieces carry enormous strategic data value for AI companies.

Using user-generated content to train large language models is rapidly becoming one of the most legally contentious data issues globally. From a technical perspective, LLM training involves extracting statistical patterns from vast text corpora; after training, the raw data does not exist in retrievable form within the model, but the model may "leak" fragments of training data under certain prompts — a phenomenon known as "memorization." From a legal perspective, the New York Times has sued OpenAI and Microsoft over this issue; multiple authors have filed class-action suits against Meta for using the LibGen pirated book database to train LLaMA; Getty Images has sued Stability AI over image copyright. These cases remain unresolved, but they have already forced AI companies to face unprecedented pressure regarding the transparency and legality of their data sourcing.

Using social platform data for AI training raises multiple legal questions: Did the privacy policy users agreed to at registration adequately disclose this use? Does the scope of permitted data use defined in the consent order cover AI training scenarios? In fact, X quietly updated its privacy policy in 2023 to add clauses related to AI training — an act that itself implies the original terms did not clearly authorize this use. Whether using the massive volume of content users generate on social platforms to train large language models falls within the data use scope agreed to in the consent order has become an urgent legal and ethical question.

This is precisely the gray area that EFF and other privacy organizations are most wary of: users who originally provided their data did not anticipate that it would be used to train AI models.

Broader Industry Warnings

The Structural Challenges of Regulatory Enforcement

This episode exposes structural challenges in enforcing FTC consent orders. While consent orders carry legal force, their implementation depends heavily on companies' voluntary cooperation and third-party audit mechanisms. When companies undergo significant ownership changes and organizational restructuring, whether original compliance commitments can be sustained — and how regulators can effectively hold them accountable — remain unresolved core questions.

Hacker News is a technology community forum operated by startup incubator Y Combinator, drawing a large community of Silicon Valley engineers, entrepreneurs, and security researchers. Since it was created by Paul Graham in 2007, it has grown into an important informal venue for tech policy discussion in Silicon Valley. Unlike platforms such as Twitter or Reddit, HN's user base is highly concentrated among technology professionals; its comment culture emphasizes technical accuracy and rigorous argumentation, with a general tendency toward "technological determinism" — a preference for technical solutions (such as end-to-end encryption, decentralized protocols, privacy-enhancing computation) over regulatory approaches, combined with skepticism about government agencies' ability to understand technology. The community's discussion of the EFF letter exhibits a characteristic "cognitive split": most technical professionals acknowledge the seriousness of data misuse, while simultaneously doubting the FTC's enforcement efficiency — the FTC has long faced structural challenges of understaffing and technical understanding that lags behind industry developments. This ambivalence reflects a deeper confusion: when existing regulatory tools respond far more slowly than the pace of technological innovation, should privacy protection rely on external regulatory constraints or on privacy-enhancing design at the technical level?

The Deep Tension Between User Privacy and AI Development

From a broader perspective, X's privacy predicament is a microcosm of the challenges facing the entire technology industry today. As the AI race continues to intensify, user data has become the most strategically valuable asset. Every major platform has strong commercial incentives to convert accumulated data into AI training resources — and this inevitably creates friction with existing privacy commitments and regulatory frameworks.

The systemic differences between the EU's General Data Protection Regulation (GDPR) and the U.S. regulatory framework make this tension even more complex. The GDPR came into force in 2018, representing a comprehensive legislative model centered on "data subject rights," requiring that data processing have one of six legal bases (such as explicit consent, contractual necessity, legitimate interest, etc.), with violations carrying fines of up to 4% of global revenue. By contrast, the U.S. still lacks unified federal privacy legislation, instead adopting a sector-by-sector regulatory model: financial data is protected by GLBA, medical data by HIPAA, children's data by COPPA, while social media data relies primarily on the FTC's anti-deception enforcement authority. This institutional gap means that U.S. privacy protection overall is weaker than in the EU — which is the fundamental reason why so many tech companies' data processing practices are legal in the United States but violate regulations in Europe. The U.S. is currently advancing the American Privacy Rights Act (APRA) legislation, though whether it will pass remains uncertain.

How to push the boundaries of technological innovation while maintaining firm commitments to user privacy will be a central challenge for regulators, technology companies, and civil society to navigate together for the foreseeable future.

Conclusion: A Systemic Test of Privacy Governance Mechanisms

EFF's letter to the FTC is far more than a case-specific inquiry about X — it is a deep challenge to the entire privacy governance framework of the digital economy era. It reminds us that legal consent orders should not stop at paper promises; they require continuous, robust oversight and enforcement as a foundation.

As AI's demand for data continues to grow, the contest between user privacy and commercial interests will only intensify. EFF's action serves both as a public warning and as an important impetus for any subsequent FTC investigation. This struggle over data sovereignty and user rights is one that everyone who cares about digital privacy should continue to follow closely.