Privacy Advocates Urge FTC to Reject X's Bid to End Data Oversight, Citing 2.8 Billion Record Leak and Grok Lawsuit

What the FTC Order Actually Is

The FTC's oversight of X dates to a consent order imposed on then-Twitter after the agency found a coding error had caused the platform to improperly use phone numbers submitted for two-factor authentication to target users with ads. This was a real violation.

Under the resulting order, X must submit to independent audits at its own expense, and the FTC can demand compliance documents without filing a new lawsuit. That's standard enforcement architecture for a company that already got caught mishandling user data.

X's Argument for Terminating the Order

X Corp. filed a petition arguing the order should be terminated for three reasons: the company has been completely rebranded since Musk took over, the order imposes costly and burdensome compliance requirements, and X already faces equivalent obligations under the European Union's General Data Protection Regulation.

The GDPR argument deserves a fair look. If X is genuinely subject to rigorous, enforceable data-handling rules in Europe that mirror the FTC order's requirements, there's a reasonable case that duplicative domestic audits create costs without proportional safety benefits. Companies operating under multiple overlapping regulatory regimes do face real compliance friction, and not every regulatory burden is automatically justified.

The rebranding argument is weaker on its face. Folding a business into a parent company does not erase legal obligations attached to the underlying platform and its data. The users, the data, and the original violation all predate the name change.

What the Advocates Are Saying

Fifteen organizations, including the Electronic Frontier Foundation, the Electronic Privacy Information Center, Demand Progress, and the National Consumers League, co-signed a letter urging the FTC to reject X Corp.'s petition to end the consent order.

Their letter argues that X's petition does not meet the legal standard required to terminate an existing consent order, and that conditions on the platform have worsened, not improved, since Musk took over.

They cite three specific developments. First, a data breach last year involving 2.8 billion records leaked from the platform. Second, a lawsuit filed by three girls accusing X of allowing its Grok chatbot to generate child sexual abuse materials and non-consensual intimate images. Third, an earlier FTC finding that Musk himself had directed employees to take actions that would have violated the existing consent order, specifically around giving journalists broad access to internal data during the "Twitter Files" release.

The advocates also flag Musk's simultaneous role running DOGE and handling sensitive government data about millions of Americans as context for why FTC scrutiny of X's data practices should increase, not end.

Separating What's Proven from What's Alleged

The original Twitter data misuse: established by the FTC. The 2.8 billion record leak: reported, though the full scope of damage and accountability remain disputed. The FTC finding that Musk directed employees toward conduct that would have violated the order: on record. The Grok CSAM lawsuit: filed, not adjudicated. The DOGE-related data concerns: alleged, not conclusively established in a legal proceeding.

The GDPR equivalence argument X is making also hasn't been tested. Whether European regulators are actually enforcing equivalent standards against X with the same rigor as an FTC consent order is an open factual question, not a settled one.

What the FTC Must Decide

The agency now has a record of public comments, with today marking the deadline for submission. The FTC must weigh whether X's changes since Musk's acquisition represent a genuine reduction in data risk or whether, as the advocates argue, they represent new and compounding risks layered on top of the unresolved original violation.

The FTC's existing authority under the order lets it monitor compliance without new litigation. That's a meaningful enforcement tool. Whether it should be preserved, modified, or terminated is the decision now in front of the agency.

No timeline has been announced for when the FTC will rule on X's petition.