X (Twitter)

Is X safe?

X will not harm your phone, but it is a weak choice on privacy and has a poorer moderation record than its big rivals. Its paid blue checkmark makes impersonation cheap, which is why the European Commission fined it €120 million in December 2025. In January 2026 its built-in AI, Grok, was used to create sexualised images of real people, including children, and regulators in the EU and UK opened investigations. We score it 37/100, level with Facebook.

The blue checkmark problem

Before 2023, a blue checkmark on Twitter meant the company had confirmed an account was who it claimed to be. Now it means someone paid. The Commission's decision of 5 December 2025 found that X's use of the "verified" label "deceives users" because X does not meaningfully check who is behind an account, and that this "exposes users to scams, including impersonation frauds".

In practice, that means fake customer support accounts for airlines and banks, cloned celebrity accounts promoting crypto giveaways, and "verified" replies under popular posts that push links. The same decision found that X's ad library leaves out who paid for an ad and that its terms ban researchers from studying public data. It was the first fine ever issued under the Digital Services Act.

Grok and the deepfake scandal

At the turn of 2026, users discovered they could ask Grok, the AI built into X, to edit photos of real people into sexualised images. The Center for Countering Digital Hate estimated that about 3 million such images were created between 29 December and 8 January. Some showed minors.

The response was fast by regulatory standards:

Date	Regulator	Action
12 January 2026	Ofcom (UK)	Formal investigation under the Online Safety Act into illegal content duties
26 January 2026	European Commission	New DSA investigation into whether X assessed Grok's risks before launching it in the EU, including possible child sexual abuse material
3 February 2026	Paris prosecutor	Search of X's Paris offices in a criminal investigation

X restricted Grok's image editing after the outcry. Ofcom called the changes welcome but kept its investigation open. Under the UK law, it can fine a company up to 10% of worldwide revenue. Indonesia, Malaysia and the Philippines temporarily blocked Grok.

What X does with your data

Apple's privacy label for X lists seven data types used to track you across other companies' apps and websites: purchases, location, contact info, user content, browsing history, identifiers and usage data. Ten categories are linked to your identity, including your contacts and search history. That is a shorter list than Instagram's, with no health or financial data, but tracking is broader than most apps.

X's record on keeping promises about data is mixed. In May 2022 the FTC and Justice Department fined Twitter $150 million because, from 2014 to 2019, it used phone numbers and email addresses that more than 140 million users had given for account security to target ads. That broke a 2011 FTC order. In May 2026 X asked the FTC to set the 2022 order aside; the agency had not ruled when we checked.

Your public posts can also be used to train xAI's models. Ireland's Data Protection Commission opened an inquiry into this in April 2025.

How to use X more safely

1. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary in the security settings, using an authenticator app or passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary rather than a text message.
2. Never trust a checkmark alone. Contact companies through their own website, not through an X reply or DM.
3. In the privacy settings, limit who can send you direct messages to people you follow, and filter low-quality notifications.
4. Review the Grok and data-sharing settings and switch off use of your posts for AI training if you do not want it.
5. Do not send private photos or sensitive information in X DMs. Use Signal or WhatsApp instead.

How we scored it

Scams and harmful content (25) is the weakest factor, reflecting the EU's findings on the checkmark and the Grok images. Privacy (30) reflects ad tracking and the FTC's findings. Regulatory record (25) is better than Meta's because X has fewer and smaller privacy fines, but several investigations are still open. Threads, Meta's rival, has the opposite profile: heavier tracking, tighter moderation.