X Wants Out of Its FTC Order 16 Years Early

Introduction

In 2022, a four-member Federal Trade Commission voted 4-0 to put Twitter under federal privacy supervision until 2042, alongside a $150 million civil penalty. That Commission is down to two members now, Chair Andrew Ferguson and Mark Meador, and on May 15 X Corp. asked those two to end the order 16 years early. Last December, the same pair voted 2-0 to set aside another AI company's consent order, citing the White House policy document X's petition quotes back at them.

The order is still running. It binds "Twitter, Inc. ... and its successors and assigns," which is X Corp. as it exists today, and it's what requires an outside auditor to inspect the company's privacy and security program every two years and X to report breaches to the government. If you still have an account there, that's this year's audit, not a post-mortem on 2013.

X's argument is that federal privacy oversight is slowing down its AI work. The FTC accepted that argument once already, in a different company's case, which turns this from a request into a procedure. The Commission hasn't voted yet, so what's actually open is whether 20 years is a term or an opening position.

The Order X Inherited

Twitter's first consent order came in 2011 and ran 20 years. In 2022 the FTC and the Justice Department found the company had broken it. Phone numbers and email addresses that more than 140 million people handed over for account security, the stuff you enter to reset a password or unlock an account, went into the ad-targeting system instead, "from at least May 2013 until at least September 2019," per the government's complaint. That penalty came with a replacement order running another 20 years, to 2042, carrying the biennial assessments and breach-reporting duties plus standing authority for the FTC to demand compliance information.

The vote was unanimous. Republican Commissioners Christine Wilson and Noah Phillips wrote separately that the order was "years in the making" and that its provisions were not "mere paperwork." They also noted it "has nothing to do with Twitter's potential sale or new ownership," months before Musk closed the acquisition in October 2022.

Two years in, FTC Chair Lina Khan told House Judiciary Chairman Jim Jordan that concern was warranted "given that Twitter's new CEO [Elon Musk] had directed employees to take actions that would have violated the FTC's Order," averted only because longtime information security staff intervened. X's petition expressly denies that account, stating the company neither violated the order nor came near violating it.

Inside the May 15 Petition

The petition runs 49 pages, filed for X by Sidley Austin. Most of it argues that the order was imposed on a company that no longer exists and that other privacy regimes already cover the same ground. The FTC's summary lists four grounds, and the fourth is the one doing the work: setting the order aside is "critical to advancing American leadership in artificial intelligence."

Here's the sentence the filing turns on. "Every hour that X's engineers spend preparing for biennial assessments, responding to demand letters, or documenting privacy reviews for features that are already governed by other legal regimes is an hour not spent building AI tools that serve users and advance American competitiveness." The order, the petition says, is "precisely the kind of outdated encumbrance that President Trump's Executive Order 14179 and subsequent AI Action Plan were designed to address."

Fifteen consumer and privacy organizations, EFF and Public Citizen among them, filed a joint opposition on July 2 calling the petition a "brazen attempt to escape accountability at the expense of the American people." X puts its compliance bill at "nearly $17 million" since 2022. The letter's own accounting comes to $16.6 million, which it calls roughly 11 percent of the penalty X agreed to pay and "a rounding error against the $200 billion valuation of X Corp. following the xAI merger."

The docket has both sides on it. A 12-state coalition led by Iowa filed in support, arguing the Biden-era FTC "weaponized" the order "to interrogate core First Amendment activities," per MediaPost's reporting on the comment file. Senators Ed Markey, Ron Wyden and Richard Blumenthal urged rejection in late July, arguing that a name change and new leadership "do not undo that legal continuity."

The FTC Already Did This Once

On December 22, 2025, the FTC reopened and set aside its own 2024 order against Rytr LLC, an AI writing company whose tool was accused of generating fake consumer reviews. The stated reason: the original complaint "failed to satisfy the legal requirements of the FTC Act," and the order "unduly burdened AI innovation." The vote was 2-0, cast by Ferguson and Meador, the same Commission that would take up X's petition five months later. Ferguson and Commissioner Melissa Holyoak had separately dissented from the original Rytr order back in 2024.

Cost by itself doesn't move this Commission. On December 5, 2025, it denied a set-aside petition from Support King, LLC, which had argued the expense of compliance. Seventeen days later it set aside Rytr's order, on the ground that the order burdened AI innovation. The connective tissue is one directive in the July 2025 AI Action Plan telling the FTC to "review all FTC final orders, consent decrees, and injunctions, and, where appropriate, seek to modify or set-aside any that unduly burden AI innovation." X's petition quotes that directive back to the agency it was written for.

That Rytr file changed how I read this petition. The standard got published first, and X's filing was built to match it.

Where the Minnesota Case Actually Stands

None of this has anything to do with Grok. The 2022 order covers ad targeting built on account-security data and says nothing about what a model produces. Minnesota is a different fight in a different court; X's own framing invites the blur.

That law, HF 1606, passed the Minnesota House 132-1 and the Senate 65-0, was signed May 7 and took effect August 1. It bars anyone who owns or controls a service from letting users nudify an image of a real, identifiable person, exempting only tools that require a user's own technical skill, with a civil penalty capped at $500,000 per unlawful use. xAI sued Attorney General Keith Ellison on July 27, calling it "an overbroad, content-based ban on free speech and the tools of visual expression" while stating it "does not contest Minnesota's interest in prohibiting the dissemination of artificially generated nude images of real people without their consent."

Judge Donovan Frank denied the emergency motion on July 31, and the reasoning was about the calendar. xAI moved "nearly three months after the law was signed, and only three days before the law is set to take effect," which the order said "suggests that harm is not immediate." The constitutional question is untouched, with Minnesota's brief due August 12 and a hearing August 19.

At least four separate legal actions over Grok's image tool were filed or escalated in the last two weeks of July, including two Arkansas families' federal suits and a July 31 ruling refusing to let xAI publicly name four anonymous plaintiffs. Nine jurisdictions have open investigations into Grok's outputs, from the European Commission's Digital Services Act proceeding to California's attorney general.

The Center for Countering Digital Hate estimated roughly 3 million sexualized images in an 11-day window around New Year's, about 23,000 apparently depicting children, extrapolated from a 20,000-image sample under a broad definition of "sexualized" it never tested against consent. xAI says it suspended more than 52,000 accounts and filed more than 73,000 reports to the National Center for Missing & Exploited Children this year, and Musk told Business Insider in January he was "not aware of any naked underage images generated by Grok."

Who Benefits

X Corp., and up the merger chain, Elon Musk. Against the $200 billion valuation the opposition letter cites, four years of compliance costs are a line item. The valuable thing is the demand power: an active order gives the FTC standing authority to ask X, on the record, how it collects and uses account data, including what feeds the models xAI is racing to ship. X says it answered more than 200 of those demands in the order's first year. Without the order, the FTC loses the authority to send more.

Timing sharpens it. SpaceX, which absorbed xAI in February, filed IPO paperwork in May, and Wired reported that the filing set aside $530 million for potential litigation losses while naming Grok's "Spicy" and "Unhinged" modes among the risk factors. A prospectus is where open federal orders get described to investors.

The Commission gets something too. Granting the petition would show the AI Action Plan has operational teeth, and it builds a template. MLex's Mike Swift reported in June that if X succeeds, "it would likely trigger other big tech companies to seek similar forgiveness of their privacy orders." Accepting the petition for public comment, over a unanimous bipartisan order and fifteen organizations' objection, costs the agency nothing.

Twenty Years Was Supposed to Mean Twenty Years

A 20-year term exists to outlast the people who caused the problem. Executives leave and companies get sold, and the order stays with the corporate entity, which is why "successors and assigns" sits in the definition of who's bound. X's central argument, that the order was imposed on a company that no longer exists, is an argument against how consent orders are built rather than against this one.

There's also a gap between the grievance and the remedy. The most concrete complaint in the petition, echoed by the 12 states backing it, is that the previous FTC used its demand-letter authority to run investigations the states say had nothing to do with consumer privacy, including a December 2022 letter seeking information tied to the "Twitter Files" disclosures. If that's the injury, the fix is narrowing that authority. The petition asks for none of that: it asks the Commission to terminate the whole order 16 years early, biennial audits and breach reporting included, and neither of those has anything to do with demand letters.

The Bottom Line

Nothing is decided. The comment period closed July 2 and the Commission still hasn't voted, with no date announced. Minnesota's August 19 hearing runs on its own clock, and xAI's constitutional argument there hasn't been tested; the motion it lost turned on a delay of nearly three months.

A federal privacy order, imposed unanimously by a bipartisan Commission after six years of documented deception affecting more than 140 million people, is now something a company can ask two commissioners to lift by citing a White House policy document, four years into a 20-year term. Rytr proved the rationale works on a small AI startup, and X is the test of whether it works on a company that paid $150 million. Whatever those two decide will sit in the file the next time a platform decides its own 20-year order has run long enough.