Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
On May 25, 2022, Twitter Inc. agreed to pay a $150 million civil penalty to resolve allegations by the U.S. Department of Justice and Federal Trade Commission that it misrepresented how it used users’ phone numbers and email addresses. Twitter said the information was collected for account security, but regulators alleged it was also used to help advertisers target users.
The payment went to the government—not directly to affected users—and the settlement also required changes to Twitter’s privacy, security, disclosure, and multifactor-authentication practices.
What the Twitter privacy settlement was about
The case centered on a mismatch between Twitter’s stated purpose for collecting contact information and the additional use regulators alleged was not disclosed.
Twitter told users that phone numbers and email addresses could be used for purposes such as:
#1 Best Overall
- Password resets and recovery
- Account reauthentication
- Unlocking accounts blocked after suspicious activity
- Two-factor authentication
According to the FTC’s complaint and announcement, Twitter also used the information to support targeted advertising. The government alleged that Twitter’s advertising systems could match contact information it held with information supplied by advertisers or data brokers, allowing advertisers to reach selected audiences.
That does not necessarily mean Twitter handed every advertiser a raw list of users’ phone numbers or email addresses. The government materials describe audience matching and targeting, rather than establishing that all affected contact details were directly disclosed to advertisers.
How many users were affected?
The FTC said that more than 140 million users provided phone numbers or email addresses during the relevant period. The complaint described the alleged conduct as spanning May 2013 through September 2019, while the FTC’s public summary referred to users who supplied the information from 2014 through 2019.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That figure does not mean every Twitter user was affected, nor does it establish that every person’s information was used in the same way. It represents the number of users the FTC said provided the relevant contact information during the cited period.
Why the 2011 FTC order mattered
The 2022 matter involved more than a new allegation of misleading data use. Regulators also alleged that Twitter violated a 2011 FTC order concerning representations about the security, privacy, confidentiality, and integrity of nonpublic consumer information.
The earlier order followed allegations involving misleading privacy and security practices, including two data breaches. The FTC and DOJ alleged that Twitter’s later conduct violated both the FTC Act and the existing order.
In practical terms, the prior order made the alleged failure to disclose the advertising use especially significant: regulators said Twitter had already been subject to restrictions regarding how it represented its handling of users’ nonpublic information.
Recommended Free Tools
Was the $150 million a fine, and did users receive money?
The government described the payment as a civil penalty and monetary judgment. It was not a criminal fine, and this was not a consumer class-action settlement that distributed money to users.
The settlement resolved government allegations in federal civil court. It did not create an automatic refund, check, or claim payment for people whose contact information may have been involved. The matter was filed in the U.S. District Court for the Northern District of California.
It is also more precise to say Twitter agreed to pay to resolve allegations than to say it was criminally convicted or definitively found to have stolen users’ data. The Justice Department announcement described the agreement as a settlement of the government’s claims.
What else did the settlement require?
The $150 million payment was only one part of the resolution. The settlement required Twitter to:
- Stop profiting from the deceptively collected data.
- Implement a comprehensive privacy and data-security program.
- Explain why and how it collected, shared, and used personal information.
- Notify affected users about the practices at issue.
- Offer a multifactor-authentication option that did not require users to provide a phone number.
The FTC’s consumer explanation highlighted the phone-number-free authentication option. Depending on the service and its available settings, alternatives such as an authenticator app or security key can reduce the need to use a phone number for account protection. The settlement itself should not be treated as proof that all current X privacy or advertising practices remain unchanged.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Timeline of the case
| Date | What happened |
|---|---|
| 2011 | The FTC issued an order concerning Twitter’s representations about privacy and security. |
| 2013 | The complaint said Twitter began the relevant period of collecting contact information for security-related purposes. |
| 2014–2019 | The FTC said more than 140 million users provided relevant phone numbers or email addresses during the period cited in its public summary. |
| September 17, 2019 | Twitter said the issue had been addressed by this date. |
| May 25, 2022 | The DOJ and FTC announced the $150 million settlement. |
| May 26, 2022 | The FTC case record listed the stipulated order and related settlement documents. |
What Twitter said
Twitter said the settlement concerned a privacy incident disclosed in 2019. In its company statement, Twitter said some email addresses and phone numbers supplied for account security “may have been” used for advertising purposes, that the issue had been addressed as of September 17, 2019, and that the company had cooperated with the FTC.
That statement represents Twitter’s characterization of the matter. The allegations and required remedies came from the government’s civil enforcement action.
What users should take away
The case illustrates why the stated purpose of data collection matters. Contact information supplied for security can also have value in advertising systems, particularly when it can be matched with information held by advertisers or data brokers.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteFor users, the key financial and privacy point is straightforward: the $150 million did not become a payout fund for affected Twitter users. It was a government civil penalty, accompanied by restrictions and compliance requirements intended to address the alleged deceptive use of account-security information.
The settlement involved Twitter Inc. in 2022, before the company’s later rebranding as X. It should not be presented as a new 2026 enforcement action or as a guarantee about the company’s current privacy practices.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
