X Corp seeks to end 20 year privacy decree

X Corp filed on May 15 with the Federal Trade Commission to set aside or modify a 2022 order that requires the company to report regularly to the FTC about its data practices after a high profile privacy violation. The order followed a settlement stemming from claims that the platform misused user data, including phone numbers and email addresses given to secure accounts, for targeted advertising. The violation carried a $150 million penalty, underscoring the severity of the case and the FTCs willingness to attach long term oversight to privacy reforms. The 2022 order was described as a renewal of an earlier obligation that fans out over decades, ultimately extending to 2042. X Corp contends that a corporate overhaul and a fresh privacy and information security program mean the decree should be set aside or narrowed.

The petition has become a flashpoint for a broader debate about how much model oversight should survive a name change or a corporate reboot. Privacy advocates, led by the Electronic Frontier Foundation (EFF), joined by Demand Progress Education Fund, the National Consumers League, and the Electronic Privacy Information Center, urge the FTC to reject the request. They argue that reshuffling a brand or leadership does not erase past missteps or the need for ongoing accountability. The filing period is part of an open comments process, signaling that a wide range of voices will weigh in on how aggressively the agency should police long tail consent decrees tied to large scale data practices.

For compliance officers and tech leaders, the case is a test of how durable enforcement commitments are when a company tries to reframe its privacy posture. The decree is not merely a one off penalty; it binds X Corp to a continuous reporting cadence about its security posture and data safeguards, a mechanism that keeps the agency apprised of risk and remediation progress over two decades. If the FTC grants X’s petition, proponents warn that the obligations could be curtailed far sooner than planned, potentially reducing a watchdog mechanism that regulators view as critical for restoring trust after a data exposure.

From a practitioner lens, the most immediate tension is control versus transparency. On one hand, a company might want to consolidate privacy governance around a renewed program and reduce procedural baggage. On the other hand, the decree’s reporting requirement acts as an ongoing external check that can catch missteps early and publicly demonstrate remediation, and it sends a signal to users that privacy commitments endure beyond leadership changes. The enforcement lever here is explicit: regular FTC reporting, safeguards on user data, and the substantial $150 million penalty that remains part of the record unless the order is modified. The practical implication for compliance teams is clear; any settlement revision will change the cadence and depth of external oversight, altering risk calculations, audit planning, and incident response playbooks.

Industry watchers will also be watching for how the FTC weighs the balance between encouraging corporate reinvestment in privacy and ensuring lasting accountability. The X petition tests whether a retooled privacy program can substitute for decades of externally mandated reporting, and it could set a precedent for other platforms facing consent decrees tied to past data practices. If the FTC sides with the petition, expect a wave of questions about whether future restructuring can reset or shorten enforceable privacy obligations. If it rejects it, the agency signals that such orders remain binding despite branding or leadership shifts, keeping the long tail of oversight intact.

In the end, the outcome will shape how heavy a hand regulators keep on privacy governance after a name change or organizational overhaul, and how rigorously platforms must demonstrate progress to the public and to the FTC over the long haul.