Dropbox Dash's browser extension demands 'read and change all your data on all websites'

Dropbox's revised Terms of Service, posted 1 September 2026 and effective 1 January 2027, change the inactivity test for accounts without a Paid Account from 12 consecutive months to 6, raise the minimum age to 18, and say that maintaining an account after the update takes effect means agreeing to the revised Terms. Dropbox's inactive-account help page, updated 31 August 2026, still describes a 12-month test.

A Seventh Circuit decision (No. 25-1536, 171 F.4th 587, 5 May 2026) affirmed a district court's finding that one criminal defendant had consented, by accepting Dropbox's terms of service, to Dropbox's review of his files, writing that "The language of this contract unambiguously permits Dropbox to scan all files at its option". A petition for certiorari (Supreme Court No. 26-460) is pending, with the government's response due 7 December 2026.

On 10 September 2026 Dropbox announced, together with OpenAI, a native Dropbox experience inside ChatGPT. Users who connect their account can browse, search, @mention and preview Dropbox files there. Four Dropbox pages captured for this entry describe permissions and a per-user disconnect path, but none of them states whether content sent to ChatGPT is used to train models, how long OpenAI retains it, or any admin switch to block the connector.

Because Dash can be downloaded and set up with 'no sales or IT required,' an individual employee can connect and index an organization's apps and browser history without administrator oversight — recreating the shadow-IT data-governance risk that earlier consumer Dropbox use posed to enterprises.