Perspectives: Technology, Global Privacy & Data Protection Law
By Sally Vazquez-Castellanos, Esq.
Published on October 12, 2026 at approximately 8:28 am.
A platform’s privacy promises are only as reliable as the practices behind them. In August 2022, Senators Dick Durbin and Chuck Grassley announced a Senate Judiciary Committee hearing to examine former Twitter security chief Peiter “Mudge” Zatko’s allegations of widespread security failures and foreign-state interference. Their announcement raised serious concerns while expressly recognizing that the allegations required investigation. (judiciary.senate.gov)
In his September 13, 2022 written testimony, Zatko alleged that Twitter had longstanding critical security deficiencies and that leadership misled its board, regulators, and the public. He described risks extending beyond individual accounts to public discourse and national security. These statements were whistleblower allegations, not judicial findings. (judiciary.senate.gov)
The chronology also matters. Jack Dorsey resigned as Twitter’s CEO on November 29, 2021, months before the public disclosure and Senate hearing. His stated explanation was that Twitter was ready to move beyond its founders. These records do not establish that cybersecurity failures caused his departure; Zatko’s testimony described Dorsey as committed to security improvements when he recruited him. (sec.gov, judiciary.senate.gov)
Separately, Twitter agreed in May 2022 to pay a $150 million civil penalty to resolve FTC and DOJ allegations that it used telephone numbers and email addresses collected for account security to help target advertising without disclosing that additional purpose. That enforcement matter illustrates how information supplied to protect a person’s account can become a source of commercial exploitation. (justice.gov)
For privacy governance, the enduring question is whether companies can substantiate their assurances: who can access personal information, how it is used, whether security deficiencies are corrected, and whether decision-makers receive accurate reports. Meaningful accountability requires evidence of those practices. The 2022 Twitter record remains instructive, but it does not establish the present security condition of Twitter/X.
Sources: Senate Judiciary Committee, hearing announcement (Aug. 24, 2022); Peiter Zatko, written testimony (Sept. 13, 2022); FTC, Twitter privacy enforcement announcement (May 25, 2022).
This commentary provides general information and does not constitute legal advice or create an attorney-client relationship.
Disclosure: This summary was prepared with assistance from ChatGPT.