Elon Musk’s X is changing its privacy policy to allow third parties to train AI on your posts

While X owner Elon Musk trained xAI’s Grok AI chatbot on X user data, leading to an investigation by the EU’s lead privacy regulator, the company hadn’t yet amended its policy to indicate its data may also be used by third parties.

The addition to the policy implies that X, like Reddit and various media organizations, is looking into licensing data to AI companies as a potential new revenue stream.

In Section 3 of the updated Privacy Policy titled “Sharing Information,” X added a paragraph detailing how X user data can be used and how users could opt out.

It reads:

“Third-party collaborators. Depending on your settings, or if you decide to share your data, we may share or disclose your information with third parties. If you do not opt out, in some instances the recipients of the information may use it for their own independent purposes in addition to those stated in X’s Privacy Policy, including, for example, to train their artificial intelligence models, whether generative or otherwise.”

The policy points to the settings page on X, but does not specifically indicate where users would go within the settings to toggle off data-sharing. Currently, the “Privacy and safety” section in settings lets users turn on or off data-sharing with xAI’s Grok and with other “business partners,” but the latter is described as those companies that X may work with to “run and improve its products,” not other AI providers.

That may be because the updated privacy policy won’t become effective until November 15, at which point the opt-out option could be added. (We hope.)

In addition, the company removed a paragraph that said it keeps user “profile information and content for the duration of your account,” and that it keeps other “personally identifiable data we collect when you use our products and services for a maximum of 18 months.”

Instead, the new section explains that X will keep “different types of information for different periods of time, depending on how long we need to retain it in order to provide you with our products and services, to comply with our legal requirements and for safety and security reasons.” As an example, it notes that usage information like the “content you post” and your interactions with others’ content will be kept for “the duration of your account or until such content is removed.”

The policy also added a note reminding users that public content can exist elsewhere even after it’s removed from X. This could potentially cover the data’s ingestion by AI providers, as X adds, “search engines and other third parties may retain copies of your posts longer, based upon their own privacy policies, even after they are deleted or expire on X.”

Separately, X has added a new “Liquidated Damages” section to its updated Terms of Service that says any organization scraping its content will be liable for damages. Specifically, “for requesting, viewing, or accessing more than 1,000,000 posts (including reply posts, video posts, image posts, and any other posts) in any 24-hour period,” X says the organization will be charged $15,000 USD per 1,000,000 posts. 

The move to monetize X data follows advertiser withdrawals and boycotts and a subscription feature that has yet to take off, which have left the company in need of new ways to pay its bills.

X did not respond to a request for comment.