We read X's new privacy policy so you don't have to

Twitter - excuse us, X - has a new privacy policy. It's a long, boring read. But we've done the work for you, and unfortunately, the changes aren't particularly good for your privacy.

First, a little background. As you're probably aware, Twitter is no longer Twitter; it is now X, courtesy of new owner Elon Musk, who wants to turn it into "everything app." That means that Twitter (sorry, X), is gradually changing from "yell at the world in short message format" app into "chatting, blogging, sharing videos, making calls, personal finance, and basically everything else" app.

It is only logical, then, that the app's terms and conditions, as well as privacy policy, needed some updating. But given Musk's propensity for basically doing whatever the heck he wants on X, it's worth taking the time to understand what using X means for your privacy.

Current Privacy Policy vs. new Privacy Policy

Firstly, the old privacy policy, which X calls "Current Privacy Policy" is still in effect and will remain so until Sept. 29, 2023.

The new privacy policy, which X calls "X Privacy Policy," goes into effect on September 29, 2023.

It's nice of Twitter (X) to have both documents online so you can compare them, though doing it side-by-side or running them through an automated comparison tool is still a drag, as you can only download the old (current) policy in PDF format.

So, what's new?

Most noticeably, instances of "Twitter" were changed to "X," while "tweets" were changed to "posts." Also, all mentions of "Periscope," Twitter's streaming video feature, were removed (Periscope was killed off in March 2021).

There are some interesting bits, and some slightly worrying bits, though deciphering what, exactly, they mean is not entirely straightforward.

One new sentence, added to the "Sharing Information" chapter, says that Twitter may share your information with an "applicant tracking system providers to send and receive applicant and job data to potential employers," which is likely related to X's upcoming job listings platform.

There's also a new paragraph saying that the X Privacy Policy is written in English and translated to other languages, but in case of "any discrepancies or inconsistencies, the English language version of the X Privacy Policy shall take precedence."

Also, a new sentence under "Objecting to, Restricting, or Withdrawing your Consent" says the following: "You may also manage additional settings when interacting with certain content and features on different parts of the platform, such as whether a Space is recorded, or whether videos you upload are downloadable by others." This implies that managing your privacy settings over at https://twitter.com/settings/account may not be enough to take care of privacy settings for every feature on X, and you may to dig a little deeper to find them.

The worrying parts

Is there anything in there you should be concerned about? Yes.

The first bit, under "Usage Information," says X may collect information on the "metadata related to Encrypted Messages." Ideally, the company should collect as little of such metadata as possible, though collecting some of it is sometimes unavoidable.

For comparison, check out privacy-oriented chat app Signal's Privacy Policy, which states that "Additional technical information is stored on our servers, including randomly generated authentication tokens, keys, push tokens, and other material that is necessary to establish calls and transmit messages. Signal limits this additional technical information to the minimum required to operate the Services." X, too, should perhaps elaborate on what type of metadata it stores.

Here's the key issue. X says that it may use the information it collects "to provide you with products and services, to help keep X more secure and respectful for everyone, and more relevant to you." Then, in later chapters, it lists several ways in which it may use the information it collects, which includes sharing it with partners, service providers, and advertisers. But there's no clear info on what types of information get used for which purpose. This was an issue in the old privacy policy, too; the new bit is just the part about the metadata related to encrypted messages, which were added in May this year and are still quite lacking in terms of the features they offer.

Then there's a new sentence in the part of the document where X explains how it uses the information it collects from users says "we may use the information we collect and publicly available information to help train our machine learning or artificial intelligence models for the purposes outlined in this policy."

In other words, the data you hand over to X may (and probably will) be used by AI, which is a trend among tech companies. For example, Zoom added similar wording to its terms of service earlier this month, though the users will be able to choose not to share their data for some AI-related purposes. And in July, Google amended its privacy policy to say that is could use public data to help train and create AI products.

Perhaps the most worrying part of the new policy is the fact that Twitter now "may collect and use your biometric information for safety, security, and identification purposes." The good news here is that this is "based on your consent," so hopefully users will be able to opt out of it completely.

Finally, Twitter now "may collect and use your personal information (such as your employment history, educational history, employment preferences, skills and abilities, job search activity and engagement, and so on)." This is done, according to Twitter, to "recommend potential jobs for you, to share with potential employers when you apply for a job, to enable employers to find potential candidates, and to show you more relevant advertising."

To summarize: Compared to the old privacy policy, there are now several very important new types of user data that Twitter collects, including employment and educational history, as well as biometric data. The company also plans to use that data in new ways, most importantly to train AI. Have this in mind before you hand over your data to X.