Elon Musk tries again to escape FTC audits of X data handling - Ars Technica

Skip to content

AI

Biz & IT

Cars

Culture

Gaming

Health

Policy

Science

Security

Space

Tech

Forum

Subscribe

Story text

Size

Small<br>Standard<br>Large

Width

Standard<br>Wide

Links

Standard<br>Orange

* Subscribers only

Learn more

Pin to story

Theme

Search

Sign In

Sign in dialog...

Text<br>settings

Story text

Size

Small<br>Standard<br>Large

Width

Standard<br>Wide

Links

Standard<br>Orange

* Subscribers only

Learn more

Minimize to nav

Critics hope to keep Elon Musk from escaping a strict data-privacy order imposed by the Federal Trade Commission (FTC) shortly before he took over Twitter.

The FTC order placed restrictions on X’s data use for 20 years, while requiring regular independent audits and granting the agency authority to request documents as needed to ensure compliance.

The FTC’s action came after Twitter voluntarily disclosed that between May 2013 and September 2019, a coding error accidentally allowed phone numbers and email addresses that users shared for two-factor authentication purposes to be used for targeted advertising aimed at those same users. In a settlement that came just months before Musk’s 2022 takeover, Twitter agreed to pay $150 million and to allow the FTC to monitor the platform’s data-handling practices until 2042 in order to protect user privacy.

Musk tried and failed to get the order revoked in 2023. At that time, Musk accused the FTC of aggressively increasing the number of investigative demands. He claimed that the order was improper and should be terminated because the agency was “tainted by bias.”

In response, the FTC pointed out that Musk’s takeover of Twitter raised genuine questions about the company’s ability to comply with the order, particularly after he terminated key staff who for years had ensured compliance. One engineer confirmed in a deposition that layoffs and other “cost-cutting pressure and decisions” impaired X’s ability to “put technical restrictions and controls in place… around the company’s use of contact data to make sure that it was being used… for the purpose that the particular contact data was collected,” the agency’s filing said.

“No one was responsible for about 37 percent of X Corp.’s privacy program controls,” the FTC argued.

Also raising red flags for the FCC were Musk’s demands that journalists get access to internal systems for the “Twitter Files” as well as a text from Musk insisting that an executive assistant gain access to systems “immediately,” threatening that “anybody standing in the way” would “be fired.” In 2024, the agency claimed that X security staff sometimes had to pointedly disobey Musk in order to remain in compliance. As Twitter’s functionality became spotty through steep layoffs, the FTC argued that it had “every reason to seek information about whether these developments signaled a lapse in X Corp.’s compliance.”

Musk lost his previous lawsuit after the court found it had no authority to amend or end the FTC’s order. Musk is trying again with new arguments, complaining in a May petition to the FTC that they should set aside the order “without delay.”

According to Musk, the FTC should stop its monitoring because Twitter no longer exists, as X was merged into xAI, and then xAI was folded into SpaceX. Musk also argues that since none of the leadership or engineers responsible for the two-factor authentication error remain at the company, and “X has since built a world-class privacy and data-protection program” that protects consumers, the FTC doesn’t have to intervene anymore.

The company further argued that it has paid $17 million in “needless costs,” since a lawsuit over the same two-factor authentication issue ended with a verdict in Twitter’s favor. If a court found that Twitter’s privacy policy adequately informed users that their contact info might be used for ad targeting, then the FTC should not be able to continue punishing X for that behavior, Musk argued.

“The factual foundation of the FTC’s complaint has been dismantled,” X says. “And the Order’s staggering costs—imposed on both the Company and on the Commission itself are unjustifiable.”

As X sees it, the order also requires the company to duplicate compliance efforts, because X already must take extra precautions with data to comply with laws such as the European Union’s General Data Protection Regulation (GDPR).

Finally, X raised two other claims to justify tossing the order. First, X claimed that allowing the FTC to maintain the order would chill speech on X, because it supposedly “creates a permanent mechanism through which future regulators can pressure the Company over the viewpoints it hosts.”

And second, X argued that Donald Trump’s AI Action Plan requires government agencies to drop orders such as this one. Since X is “at the center of a family of companies—including xAI—that are at the forefront of America’s AI ambitions,” the FTC risks running afoul of...