Twitter says a bug led to the “Protect your Tweets” setting being disabled for some Android users for almost five years, making their tweets public
Twitter accidentally revealed some users' “protected” (aka, private) tweets, the company disclosed this afternoon.
Context & Ripple Effects
This disclosure extends a run of Twitter admissions that its own infrastructure quietly betrayed user expectations: the company had already urged password resets after storing unmasked credentials in an internal log (unmasked passwords in an internal log) and fixed a bug that routed direct messages with business accounts to third-party developers since May 2017 (direct messages exposed to third-party developers). What distinguishes this incident is duration and silence — a core privacy toggle failing for almost five years without detection.
The Android-specific angle also echoes earlier mobile fragility, including the 2014 fix for login issues on Android and mobile web. Together these disclosures sketch a platform whose privacy guarantees depended on client-side settings that no monitoring caught when they broke.
First-order effects
- Some Android users who believed their tweets were protected have been public-facing for years; Twitter must now restore the setting and notify the affected accounts.
Second-order effects
- Each successive disclosure — passwords, DMs, and now a dead privacy switch — raises the cost of Twitter's 'no evidence of misuse' framing, pushing users and advertisers to weigh whether self-reported bug audits are sufficient assurance.
Third-order effects
- If silent multi-year failures of user controls keep surfacing, the likely structural response is external pressure for continuous verification that privacy settings actually hold — shifting accountability from vendor self-disclosure toward audited enforcement, a pattern the later session-logout notification (sessions left open after password resets) only reinforces.
The trend: Platform privacy is moving from promised settings to provable ones, as repeated multi-year bug disclosures erode trust in self-reported safeguards.