The 2011 FTC complaint: marketing said staff couldn't read your files; the fine print said otherwise
April–May 2011
Security researcher Christopher Soghoian filed an FTC complaint alleging Dropbox had told users their files were inaccessible even to Dropbox employees, while its actual architecture — and a quietly revised Terms of Service — made clear the company could decrypt and hand over files.
What happened
For years Dropbox's marketing reassured users that their data was safe from prying eyes. Its help pages had stated that Dropbox employees were not able to access user files, and that all files were encrypted and inaccessible without the user's password. In April 2011 Dropbox quietly revised its Terms of Service and security language to clarify that it could, and would, remove its encryption from files to comply with law enforcement requests — language that flatly contradicted the earlier 'employees can't see your files' framing.
On 11 May 2011, Christopher Soghoian — a privacy researcher and former FTC technologist — filed a complaint with the Federal Trade Commission. He argued that Dropbox had engaged in deceptive trade practices by misrepresenting how its encryption worked. The technical heart of the complaint was deduplication: Dropbox compares uploaded files against everything already on its servers and stores just one copy of identical files, which is only possible if Dropbox holds the keys and can read file contents. Because Dropbox — not the user — controlled the encryption keys, the company could access plaintext, meaning the earlier privacy assurances were, at best, misleading.
Soghoian laid out the argument publicly in a post titled 'How Dropbox sacrifices user privacy for cost savings.' The complaint also alleged that Dropbox had overstated the encryption of its mobile apps. The episode reframed Dropbox not as a vault the company couldn't open, but as a service whose convenience depended on the company being able to.
Impact
The complaint permanently changed how Dropbox could describe its own security and seeded years of skepticism among privacy-conscious users. It established the central, recurring critique of the company — that Dropbox holds the keys — and helped create the market for 'zero-knowledge' rivals such as SpiderOak. Coming just weeks before the June 2011 authentication bug that left accounts open to any password, it made Dropbox a standing example in academic and journalistic discussions of cloud-storage privacy.