Twitter’s FTC Penalty: Security Phone Numbers Used for Ads

Details you provide to secure an account should not quietly end up in advertising.

By Siddharth ShankarUpdated October 24, 2026

Two-factor authentication is one of the best protections for an account, and it usually starts with giving a service your phone number. The FTC’s case against Twitter asked a pointed question: what happens to that number afterwards? This guide follows the FTC’s own announcement.

What was announced

On May 25, 2022 the FTC, together with the Department of Justice, announced charges against Twitter, Inc. for deceptively using account security data to sell targeted ads. The complaint was filed in the U.S. District Court for the Northern District of California, San Francisco Division, and the Commission voted 4-0. The settlement was a proposed stipulated order, which takes effect as law once a District Court judge approves and signs it.

What the FTC said Twitter did

According to the announcement:

• Twitter asked users for phone numbers and email addresses to protect their accounts, for example to help them reset passwords, unlock accounts and enable two-factor authentication.
• It began requesting this information in 2013. From 2014 to 2019, more than 140 million users provided it.
• Twitter did not tell users the information would also be used for targeted advertising.
• It matched the numbers and emails with data it already held or had obtained from data brokers, which let advertisers target specific users.

The FTC said this conduct violated the FTC Act and a 2011 FTC order. It also said it violated the EU-U.S. and Swiss-U.S. Privacy Shield agreements.

The penalty and the order

The proposed order carried a $150 million civil penalty. It also:

• banned Twitter from profiting from data it collected deceptively;
• allowed users to use multi-factor authentication methods that do not need a phone number, such as authentication apps or security keys;
• required Twitter to notify users that the phone numbers and emails collected for security had been used for ad targeting, and to explain its privacy and security controls;
• required a comprehensive privacy and information security program, including assessing the privacy and security risks of new products;
• limited employee access to users’ personal data;
• required Twitter to notify the FTC of any data breach.

Why this matters

The case is a clear example of purpose creep. You hand over a phone number for one reason, and the company later uses it for another. A phone number is also a stable identifier that can be matched across datasets, which is how advertisers and data brokers link records about the same person. Read what data brokers are and what an exposed phone number means.

What you can do

1. Prefer an authenticator app or a security key for two-factor authentication where the service allows it. The FTC’s order required Twitter to offer such options without a phone number.
2. Check what is attached to your accounts. Look at the phone numbers and emails on file, and remove ones you no longer use.
3. Read the settings for ads and personalisation, and turn off what you do not want. Our guide to X (Twitter) privacy settings covers the main options.
4. Use a separate email or number for sign-ups where you can. See email aliases and temporary phone numbers for verification, and note the risks described there.
5. Do not turn off two-factor authentication. The lesson is to choose a method carefully, not to give up on protection.

A pattern across companies

Twitter was not the only company accused of reusing security data. The FTC made a similar allegation about phone numbers collected for security by another social network; read the Facebook $5 billion penalty guide. Both cases show why a company’s privacy policy matters as much as its security features.

Related exposure

Separately from this case, large collections of Twitter account data have been circulated; see the Twitter data leak guide.