Privacy groups urge FTC to keep X under data audits

Privacy and consumer groups are pressing the Federal Trade Commission to maintain oversight of X’s data practices as the company seeks to end an order requiring independent audits. The dispute matters because the order gives the FTC a faster way to demand records and check compliance after past misuse of user data.

The push came ahead of a July 2 public-comment deadline on X’s request. The FTC said last month that X argued the order is no longer needed because of changes made since Elon Musk bought Twitter and rebranded it as X.

The original FTC order followed the agency’s finding that then-Twitter improperly used contact information provided for two-factor authentication to target ads after a coding error. Under the order, X must undergo independent reviews of its privacy and security practices, and the FTC can seek compliance documents without filing a new enforcement action.

Advocates cite AI and data concerns

A group of 15 privacy and consumer advocates, including Demand Progress, the Electronic Frontier Foundation, the Electronic Privacy Information Center and the National Consumers League, told the FTC that X has not met the legal standard for ending the order. In their letter, the groups said X and its leadership still pose privacy and data-security risks that warrant continued scrutiny.

X has argued that the order is costly and unnecessary, in part because the company has changed since Musk’s takeover. The company also told the FTC that its obligations overlap with requirements under the European Union’s General Data Protection Regulation, according to the FTC notice.

The advocacy groups rejected that argument. They said Musk’s changes have created new reasons for oversight, including X’s use of public posts to train Grok and other artificial intelligence tools.

The groups pointed to criticism of Grok, including allegations in a lawsuit by three girls that X allowed the chatbot to generate child sex abuse material and non-consensual intimate images. They also cited a reported leak of 2.8 billion records from the platform and an FTC finding that Musk had directed employees toward actions that would have violated the order during the release of information to journalists for the “Twitter Files.”

The advocates also said X collected large amounts of user posts for AI training without meaningful or explicit consent, relying instead on changes to its terms. Cambridge Analytica, in a separate analysis cited by the advocates, said X’s model uses behavioral data at scale to build prediction systems, and said many users were unaware their posts could train Grok.

Cambridge Analytica also said X’s opt-out tools were hard to find and cited research finding that 73 percent of X users did not know their tweets trained Grok. The advocates told the FTC that X’s AI work should lead to more oversight, not less.

Barr supports X’s petition

Former U.S. Attorney General William Barr submitted comments supporting X. Barr said the FTC issued hundreds of information demands after Musk bought Twitter and argued that the agency should not treat consent orders as a form of permanent control over private companies.

Barr urged the FTC to end that approach or, at minimum, reopen the order to review whether its limits on X remain appropriate.

The advocacy groups said X’s legal case is flawed. They argued that the cases X cited do not show that a company can shed an FTC order because of restructuring, and they noted that X’s order is about four years old, while one cited matter involved a 20-year sunset policy and another was modified only after 16 years of compliance.

The groups also said X remains in the same core business as Twitter: operating a social media platform that uses user data for targeted advertising. They said X’s AI ambitions make the 2022 order more necessary because the company now has additional uses for consumer information.

This story draws on original reporting from Ars Technica.