After an on-by-default AI toggle caused confusion, Dropbox says user data is only shared with OpenAI if the AI-powered search feature is actively being used
AI feature turned on by default worries users; Dropbox responds to concerns. — On Wednesday, news quickly spread on social media …
Ars TechnicaBenj Edwards
Context & Ripple Effects
Dropbox had been repositioning around AI tools, first with document summarization and a universal-search product, then through Dash's open beta. This clarification therefore concerns a core part of its product strategy rather than an isolated integration.
The dispute also lands amid broader skepticism about the boundaries around customer data and model providers, reflected in the subsequent trust concerns over Dropbox's AI setting. OpenAI had previously said API-submitted data would not be used for training unless customers opted in.
First-order effects
Dropbox must distinguish between data handling during active AI search use and broader account-level sharing, while affected users can make a more informed choice about using the feature.
The default-enabled setting becomes a trust and disclosure problem for Dropbox even as it says sharing with OpenAI is limited to active feature use.
Second-order effects
Collaboration and storage vendors adding AI search face pressure to make activation, data flows, and third-party processing legible at the point of use rather than relying on broad settings.
For OpenAI, enterprise integrations increasingly depend on customers being able to explain provider data boundaries to their own users; earlier API data-use assurances become part of that scrutiny.
Third-order effects
If default-on AI features repeatedly create ambiguity, consent design and clear data-routing controls may become a competitive requirement for productivity software, not merely a privacy-policy detail.
The episode points to a durable tension in AI-enabled workplace tools: the more broadly they index user content, the more adoption depends on credible limits around when that content leaves the primary service.
The trend: AI productivity platforms are shifting from simply shipping assistants to proving that feature-level consent and data boundaries can earn user trust.
Look, I don't care HOW it is used. And yes, I know I can turn it off. THAT WAS MY POINT. I didn't consent and I am letting folks know so they can also turn it off. Don't come at me, bros.
If you are using @dropbox and do not want 3rd party AI technology partners to have access to your dropbox files, flip this switch (on by default, or did I agree to this somewhere?) (web->account->settings- 3rd party AI) /cc @EU_EDPS [image]
For those wondering who the Third Party @Dropbox just gave everyone's data automatically to, it's Open AI. Considering all the lawsuits Open AI has concerning illicit use of ill-gotten data, privacy breaches and data leaks this arrangement inspires 0 confidence.Bad move Dropbox. …
@Werner ... Still, any customer confusion about this is on us, and we'll take a turn to make sure all this is abundantly clear! More broadly, our AI principles are available here: https://www.dropbox.com/...
“OpenAI are training on every piece of data they see, even when they say they aren't” is the new “Facebook are showing you ads based on overhearing everything you say through your phone's microphone”
A lot of folks who pay for dropbox are companies or professionals who have valuable works, information and NDA's. Does this mean that Dropbox just gave access to that info to Open AI? Does this mean Dropbox is training models of said valuable information?? What a mess.
@economeager ...(2/2) Our customers are still in control of when and how they use these features, and can also opt out entirely of accessing our AI features here: https://help.dropbox.com/...
Dropbox automatically opting people in to OpenAI is such BS. It's basically, “You trust us at Dropbox right? Well, we trust OpenAI, so by extension, you should too.” It's like seeing a shady individual snoop around your storage unit, and the company is like, “Nah, he's cool.” [im…
Why do companies think they can simply and surreptitiously tweak their terms of service and break implicit understandings with their customers? The pendulum from corporate cloud to personal cloud will swing back fast.
Update: it seems this is a US & other regions issue. Anecdotally, it seems folks in the EU are opted out by default? If true, why not extend that to US customers? Regardless this is deeply troubling and Dropbox must be clear with how our sensitive data was and is being handled!
This is why OPT-IN is the only solution to generative AI. Dropbox should have never given customer data to Open AI without explicit agreement to it. Not some hidden button we have to click, or like other services have done an obscure ToS shift. A dedicated opt in program.
Dropbox states they wont train models without consent. But they JUST opted in their customers automatically. So is the implication here that they train models on your valuable and secret data unless you manually opt-out? And considering generative AI models- [image]
@timnitGebru Dropbox customer data is not used to train third-party AI models. Our customers are in control of when and how they use our AI features and if they choose, can opt out of using AI features entirely: https://help.dropbox.com/...
@economeager The third-party AI toggle is only turned on to give customers the opportunity to view new AI features, like Dropbox AI (which are clearly labeled). Neither this nor any other setting automatically or passively sends any Dropbox customer data to a third-party AI servi…
Okay, here's what's getting missed: “It only sends data if a customer uses this feature.” Reasonable if you're thinking as an end user; freaking terrifying if you run an organization / enterprise within @Dropbox and suddenly anyone in your team can trigger this.
@drewhouston ... One of the principles in there is “We will not use customer data to train AI models without consent” I've seen people upset about that specific line because they think the toggle being on by default implies they have been marked as giving “consent”
“Your data is never used to train their internal models” but somehow needs to be on their servers for up to 30 days for what? And are there external models? Is that what this language is meant to describe by omission?
Cannot forget data once its trained, does that mean if you're late to hit a hidden opt out button they JUST added, that customer data will still power gAI models? The potential implications on this alongside Open AI now having customer data is deeply concerning. Awful all around
@Werner ... The third-party AI toggle in the settings menu enables or disables access to DBX AI features and functionality. Neither this nor any other setting automatically or passively sends any Dropbox customer data to a third-party AI service.
@Werner ... Third-party AI services are only used when customers actively engage with Dropbox AI features which themselves are clearly labeled (see example screenshot), which is explained in the “Learn more” link in your screenshot: https://help.dropbox.com/...