Twitter says it has unintentionally used some email addresses and phone numbers provided for account security purposes for ad targeting
Context & Ripple Effects
This disclosure lands in the middle of a bad stretch for Twitter's data handling: in May it admitted sharing some iOS users' location data with an unnamed ad partner, and in August it disclosed two ad-targeting bugs that sent user data to ad partners without consent. The common thread is that data users hand over for security or account purposes is bleeding into the ad business.
What makes this one different is intent-adjacent framing: unlike the earlier bugs, using security emails and phone numbers for targeting is presented as an ongoing practice, not a one-time leak — which is why it later drew the FTC's attention and a potential $150M-$250M fine, and why the same contact fields resurfaced in 2022 as the target of a scraping bug used to link phone numbers and emails to accounts.
First-order effects
- Users who gave Twitter an email or phone number for login verification or account recovery now know that data may have informed ad targeting, directly contradicting the stated purpose of collection.
Second-order effects
- Regulators get a cleaner case than the 2019 bugs: a sustained practice rather than a defect, which is the pattern that later produced the FTC's six-figure-to-quarter-billion fine range against Twitter.
Third-order effects
- If security-purpose data keeps migrating into ad systems, platforms face pressure to wall off verification data from ad infrastructure entirely — and the same contact fields become the highest-value target for scrapers, as the 2022 incident showed.
The trend: Platform data practices are shifting from 'bugs we fixed' to 'practices we disclose,' with regulators and attackers both converging on the contact data users surrender for account security.