COMPANY PROFILE

X

Headquarters: Bastrop, United States · Founded: 2006

4 fines or sanctions4 data breaches

What it does and how it makes money

Social network, formerly Twitter, for posting and reading short messages, photos and videos. It is run by X Corp., which was acquired by xAI in March 2025; SpaceX acquired xAI in February 2026. All are Elon Musk companies.

It makes money mainly from targeted advertising, and also from paid subscriptions such as the blue verification checkmark. ^[1]

What data it collects about you

According to X, it keeps account data (username, email, phone, birth date), posts, login history, locations, devices and browsers, imported address-book contacts, and interests, age and gender inferred by X and its partners. It uses them, among other things, for personalised advertising. ^[2]

How it turns your data into money

X collects how you use the service, connection and device data (IP, advertising ID, installed apps, battery level), approximate location and logs even if you have no account, and may infer your identity by associating browsers, devices and hashed email addresses. Its ad partners send identifiers, hashed emails, demographic data and actions on other sites, which X combines with what it already knows to show you more relevant ads and measure their effectiveness; 'advertising revenue enables us to provide our products and services'. If you click an ad, the advertiser may learn you came from X. X states it does not sell your personal information. ^[3]

Where it is incorporated

X Corp., registered by Elon Musk in Nevada on March 9, 2023, absorbed Twitter, Inc. in April 2023; its privacy policy (effective January 15, 2026) gives its address as 800 W Cesar Chavez St., Austin, Texas, and Wikipedia reports headquarters in Bastrop, Texas since September 2024. Per Wikipedia, since March 28, 2025 it has been a subsidiary of the holding created in the merger with xAI and since February 2, 2026 it has been folded into the SpaceX group. ^[4]

Taxes and low-tax countries

X's own privacy policy names X Internet Unlimited Company, an Irish company at One Cumberland Place, Fenian Street, Dublin 2, supervised by the Irish Data Protection Commission, as the data controller for users in the EU, EFTA states and the UK. No tax ruling, tax court case or effective-tax-rate statement for X Corp. was found. ^[3]

Competition and monopoly

On October 16, 2024 the European Commission, after a market investigation opened on May 13, 2024, concluded that X's social networking service should not be designated a 'gatekeeper' under the Digital Markets Act, even if it meets the quantitative thresholds, because 'X is not an important gateway for business users to reach end users'. No antitrust finding against X was found. ^[5]

Fines and sanctions

In total: 120.5 million EUR + 150 million USD

Comisión Europea · European Union · December 5, 2025120 million EUR
Digital Services Act (DSA): the paid blue checkmark deceives users and exposes them to scams, the ad repository is not transparent, and X blocks researchers from accessing public data. ^[6]
Federal Trade Commission (FTC) y Departamento de Justicia · United States · May 25, 2022150 million USD
Settlement with the FTC: it used phone numbers and emails that users provided for security (such as two-factor authentication) to target ads, violating an FTC order. It affected more than 140 million users. These are the FTC's allegations, resolved by settlement. ^[7]
Data Protection Commission (DPC) · Ireland · December 9, 2020450,000 EUR
Failing to notify on time and to properly document a data breach: a bug in Twitter for Android made some users' protected tweets public. Confirmed by the Dublin Circuit Court on 18 October 2021. ^[8]
Federal Trade Commission (FTC) · United States · June 24, 2010
Settlement with the FTC, without a fine, over security failures that exposed accounts: it bars Twitter from misleading users about how it protects private information and requires independent security audits. These are the FTC's allegations, resolved by settlement. ^[1]

Data breaches and hacks

January 2023
A list of more than 200 million email addresses linked to accounts was posted on a cybercrime forum, compiled by exploiting a Twitter API bug that was active from June 2021 to January 2022. ^[9]
August 20225,400,000 people affected
Twitter disclosed an API bug that revealed which account belonged to an email or phone number. It was used to compile data on 5.4 million accounts (private emails and phone numbers), later shared on a forum. ^[10]
July 15, 2020130 people affected
Attackers tricked employees to get into an internal admin tool and took over 130 high-profile accounts to post a bitcoin scam. ^[1]
January 2019
A bug in Twitter for Android made protected tweets public for users who changed their email address; press reports put the number at about 90,000 EU/EEA users. ^[11]

Ask it to delete your data

This is the page the company itself gives to ask it to delete your data or stop selling it: Open its page ^[12]

With GUARDIANA or GUARDIANA ZERO, you download from this same profile the letter asking it to delete your data, under your country’s law, ready to attach to an email.

Its website

https://x.com/

Does this company follow you? GUARDIANA ZERO, GUARDIANA’s browser, cuts its connections and shows you how many times it tried. Meet GUARDIANA ZERO →

Sources

What this profile does NOT say

It does not say this company does anything illegal. The only thing it states about anyone’s legality is what a regulator or a court has already decided, with the date and the link to the source.
It does not say what data of yours it holds: only the company knows, which is why you have the right to ask it.
If you are this company and a fact is wrong, write to hola@guardianagroup.com and it will be corrected, with its date.

Public facts with their sources, checked on October 12, 2026. All profiles →