X Corp wants the FTC to release it from Twitter's 20-year privacy order. EFF and three consumer groups say it cannot.

X Corp is asking the Federal Trade Commission to set aside a consent order that has bound the company, in its earlier form as Twitter, for more than a decade. A coalition of four public-interest groups says no: corporate renaming, new leadership, and an AI strategy cannot dissolve a binding federal privacy decree.

On May 15, 2026, X Corp filed a petition with the FTC seeking to reopen, set aside, or modify the 2022 consent order the agency entered against Twitter for deceptively using account-security data. The 2022 order, a binding federal decree that requires regular reporting on data practices, resolved allegations that Twitter had taken phone numbers and email addresses provided for two-factor authentication and used them to sell targeted advertising, an abuse that touched roughly 140 million users. Twitter paid a $150 million civil penalty as part of the settlement and accepted a 20-year compliance reporting obligation.

The order was itself a renewal. Twitter first settled with the FTC in 2011 over its failure to safeguard personal information, making the current decree a second-generation obligation rather than a first. X Corp's argument, in essence, is that the corporate entity today is different enough from the one that signed those agreements that neither should bind it: new ownership, new leadership, a new privacy program, and a new AI strategy built around Grok, the model developed by Elon Musk's xAI and integrated into the X platform.

The Electronic Frontier Foundation (EFF) and three allied groups say that argument cannot stand. On July 2, 2026, EFF, the Electronic Privacy Information Center (EPIC), the National Consumers League (NCL), and Demand Progress Education Fund (DPEF) filed joint public-interest comments opposing the petition during the FTC's open comment period. In a blog post announcing the filing, EFF framed the petition as part of a broader pattern of consent-decree walk-backs at the agency, citing the FTC's earlier decision to reopen and weaken a 2023 order against the AI writing-tool maker Rytr. The pattern, EFF argues, lets companies escape privacy oversight by changing their shape rather than their practices.

The doctrine the coalition is pressing is narrower and more durable. FTC consent decrees, the opposition letter argues, bind the corporate entity, not the executives who negotiated them. A name change, an ownership transfer, or a pivot to a new product line does not retire obligations that attached to the legal person that consented to the order. To accept X Corp's framing would, in the coalition's view, hand every regulated company a template: rename, rebrand, repivot, and petition.

The letter also gives the FTC concrete reasons to find the conditions of the 2022 order unmet. According to the opposition filing, X Corp trained Grok on X user data in 2024 without meaningful consent, and the company disclosed a major data breach in 2025. Both episodes, the coalition argues, sit squarely inside the territory the consent order was designed to police. Ars Technica is independently mirroring the EFF letter, giving the filing a second public host.

X Corp's own legal theory, laid out in the public petition, leans on the gap between the company Twitter was in 2011 and 2022 and the company X Corp is today. The coalition's response is that the consent decree was never a contract with a management team. It was a contract with a legal entity, and that entity remains. A third-party legal analysis reads the petition in the same deregulatory frame EFF describes, though that view comes from one niche analyst rather than the FTC itself.

The FTC has not signaled when it will rule. The question the agency now faces is not whether X Corp has changed; it is whether changing is enough to retire a federal data order. If the FTC grants the petition in whole or in part, the precedent will reach well beyond Musk's platform: any company subject to a long-tail privacy decree could read the ruling as permission to seek an early exit. If the FTC denies it, the agency will have reaffirmed that consent decrees travel with the corporate entity, not the executives who signed them.

The next trigger is the FTC's response to the comment period, which closes with the coalition's filing. Until then, the legal status of the 2022 order remains intact, and X Corp remains bound by the reporting and consent obligations it inherited from Twitter.