X Corp Wants Out of Its Own Privacy Order — the FTC Shouldn't Let It
In 2022 the Federal Trade Commission found that X Corp — then still Twitter — took the phone numbers and email addresses 140 million users had handed over specifically to secure their accounts and quietly repurposed that data to sell targeted advertising. Not a bug. Not an edge case some engineer missed in a sprint review. A business decision, made and kept, until the FTC caught it. The remedy: a $150 million fine, and a consent decree requiring years of ongoing compliance reporting under FTC Act Section 5.
Four years in, X Corp isn't reporting more. It's asking the FTC to make the order disappear.
The timeline:
2022 — FTC finalizes the order. X Corp admits no wrongdoing but accepts the fine and the reporting obligations.
May 2026 — X Corp files a petition asking the FTC to set aside or modify the order.
June–July 2026 — The FTC opens a public comment window. It closes July 2, 2026.
June 2026 — The Electronic Frontier Foundation, joined by allied organizations, files formal opposition, arguing the petition should be rejected outright.
As of this writing — the FTC has not ruled.
Here's the math that makes "$150 million" mean something instead of just sounding like a number. Divide it across the 140 million accounts whose security data got repurposed, and it comes out to a little over a dollar per person. A dollar, for handing over your phone number under one pretense and having it used for another. And 140 million people is more than the entire population of Japan — that's the scale of the population X Corp treated as an advertising resource instead of the security opt-in they believed they were giving.
A consent decree is not a tax you finish paying down. It's supervision you earned by getting caught lying about what you were doing with someone else's data. You don't get out of supervision early because enforcement got tiring, or because a new petition sounds reasonable in a filing. You get out of it by demonstrating, over time, that you no longer need it — and asking four years after the fact, over the formal objection of the people who watch this space for a living, is not that demonstration.
X Corp: you were not fined for a mistake. You were fined for lying about what a phone number was for. If the FTC vacates this order over EFF's objection and a closed public comment record full of "no," it isn't closing a compliance chapter — it's teaching every company under a consent decree that noncompliance is a phase you lobby your way out of, not a debt you pay in full.
This is the pattern: institutions redefine the terms of accountability once the accountability becomes inconvenient. Shrink the definition until the obligation shrinks with it. Watch what the FTC does with this one. It'll tell you whether a consent decree still means anything, or whether it's just a fine with a snooze button.