• Badge: ⚠️ Caution
• Red Flags:
  • RF1 — Own advertising / cross-service profiling
  • RF2 — High-risk third-country exposure without meaningful mitigation
  • RF4 — Significant opacity
• Risk Indicators:
  • Own-purpose data use (advertising); intrusive tracking; high-risk international transfers; opaque AI training

Key Facts: Twitter/X is an advertising-funded platform with extensive user profiling for targeted advertising (RF1). X Internet Unlimited Company (Dublin) is EEA controller but all data processing and access occur in the US (RF2). FTC fined Twitter $150 million (May 2022) for using 2FA phone numbers to serve targeted ads — documented purpose violation. NOYB filed complaints in 9 EU countries (Aug 2024) over Twitter/X training Grok AI on EU user data without consent; Irish DPC obtained emergency court order halting this (RF4 — opacity regarding AI data use). Irish DPC previously fined Twitter €450,000 (Dec 2020) for data breach notification failures.

Framework Note (v2.2): FRAMEWORK NOTE (v2.2): RF2 (high-risk third-country exposure) is recorded here as a significant risk factor and lowers the domain E score. Under the revised framework, RF2 alone does not trigger Caution — the Caution badge for this service is driven by RF1 / RF3 / RF4 (as noted above). The US transfer risk (where applicable) is covered by DPF participation and/or SCCs, which GDPR treats as a compliant transfer mechanism.

Quellen:

• Twitter/X Privacy Policy (x.com/en/privacy)
• Twitter Developer Policy
• FTC Twitter settlement ($150M
• May 2022, ftc.gov)
• Irish DPC Twitter court action (Aug 2024, dataprotection.ie)
• Irish DPC Twitter fine (€450K
• Dec 2020, dataprotection.ie)
• NOYB Twitter AI complaints (noyb.eu).

• Unlock additional website features
• Support marketing analytics
• Receive personalised marketing offers
• Customise online ads (non-TCF)

• TPP Notified?: Not yet notified
• Decision Contested?: [nicht dokumentiert]