X Seeks FTC Relief From 2022 Privacy Order

X seeks relief from the Federal Trade Commission from the 2022 privacy order, inviting fresh scrutiny of its data safeguards. The filing, submitted May 15 as part of an open comments period, asks the agency to set aside or modify a consent decree that requires regular reporting on privacy and security practices after findings that the platform misused user data to secure accounts for targeted advertising. The scale of the case is notable: the 2022 order is a renewal of a prior settlement, tied to a 150 million dollar penalty and a long-running obligation to disclose security posture. The outrage centers on alleged misuse of personal information from roughly 140 million users, a pattern that regulators and privacy advocates say justified the original enforcement. The FTC's 2011 settlement with Twitter, now X, barred misrepresenting data protections and mandated safeguards and ongoing reporting for two decades; the 2022 renewal extended that oversight to 2042 unless modified. Now, X argues that a corporate reboot, with new leadership and a redesigned privacy program, means it has "built an entirely new" program and should not be bound by a decree framed around older practices.

The petition has drawn a chorus of criticism from privacy and consumer groups. The Electronic Frontier Foundation (EFF) and allies Demand Progress Education Fund, the National Consumers League, and the Electronic Privacy Information Center urge the FTC to reject the request. They contend that X's assurances about a new program do not erase past misrepresentations or the sustained risk to user data exposed by the prior violations. The filing notes that the order compels ongoing reporting and oversight to monitor compliance, a check that remains critical given the multi-year, high-stakes nature of data security obligations. For stakeholders watching the tech sector, the case signals how aggressive regulators will treat corporate rebranding as a potential evasion tactic rather than a genuine reset of practices.

From a compliance perspective, the case highlights several practical dynamics. First, consent decrees tied to privacy violations carry enforcement teeth long after the violations occur, via regular reporting and audits that can be extended decades. Second, a name change or leadership overhaul does not automatically disentangle a company from historic compliance duties; the decree's footprint often persists to ensure accountability and public trust. Third, for platforms monitoring a public relations risk calculus, a potential rollback of obligations would alter the incentives around disclosure and posture reporting, possibly affecting how they communicate security measures to users. Fourth, the timing matters: the open comments period creates a window for reactions from safety advocates and others who can influence the FTC's decision path, which in turn shapes budgeting for privacy programs and the cadence of external audits.

What to watch next is how the FTC weighs the credibility of X's claims about a new privacy framework against the record of past data handling and the public harm cited in the consent decree. If the petition is denied, the 2022 order continues in force, maintaining long-term oversight through 2042. If granted in whole or part, the agency could recalibrate reporting requirements, modify the scope of the order, or wind down elements of the decree, with ripple effects for other platforms facing similar consent decrees. The FTC's decision will signal how agency enforcement will balance corporate reorganization with the imperative to protect user data and maintain transparent accountability.