6 November

Under X's privacy policy in effect since 15 January 2026, creating an account on X (formerly Twitter) requires either an email address or a phone number, and whichever you give is associated with your account. On 6 November 2019, the US Attorney's Office for the Northern District of California made public a criminal complaint (an allegation not yet tested at trial) charging two former Twitter employees and a Saudi national with acting as illegal agents of the Saudi government. According to the Justice Department's press release, the two employees used their employee credentials without authorisation to look up information on users critical of the Saudi government, including email addresses, phone numbers, IP addresses and dates of birth that could have been used to identify and locate the people behind the posts. Later Justice Department press releases and the Supreme Court's ruling show that a jury convicted one of the former employees in 2022 and he was sentenced to 42 months in prison, and that in June 2026 the Supreme Court reversed and remanded the appeals court's judgment on a single count, falsifying records, over where that charge could be tried. Carriers in Taiwan, Hong Kong, South Korea and Japan must confirm a subscriber's identity when issuing a mobile number (in Singapore, a licence condition for prepaid cards), so we infer that a phone number on an X account may lead back to the person it is registered to.