Dropbox Watchdog

Search issues

Search the Dropbox Watchdog archive

All issues
Privacy & Encryption Concerns

The iOS privacy 'nutrition label': how much the Dropbox app says it collects

2020 (introduced); ongoing

LowStatus: OngoingProduct: Mobile appsYear: 2020

Apple's App Store privacy 'nutrition labels,' introduced in December 2020, require apps to disclose their data collection — and the Dropbox app's label lists a broad range of data linked to the user's identity, from contact info and identifiers to usage data and diagnostics.

What happened

In December 2020 Apple began requiring every App Store app to publish a privacy 'nutrition label' summarizing the categories of data it collects and whether that data is linked to the user or used to track them across other apps and websites. The labels surfaced, in one place, how much information cloud apps gather beyond the files users knowingly upload.

Dropbox's iOS app label discloses collection across multiple categories of 'data linked to you' — including user content, contact information, identifiers, usage data, and diagnostics — reflecting the metadata, device, and behavioral signals the app gathers in addition to file contents. Dropbox developers themselves sought guidance from Dropbox on how to fill out Apple's data-collection and tracking questions when their own apps merely use the Dropbox SDK, underscoring how much data flows through the integration. The disclosures are self-reported by the developer and describe categories rather than exact fields, so they understate granularity.

Impact

The nutrition label gave ordinary users a rare, standardized view of the breadth of Dropbox's mobile data collection, reframing Dropbox not merely as a place to keep files but as an app that — like most — also harvests identifiers, usage, and diagnostics tied to the account. It fed broader scrutiny of how 'storage' apps quietly accumulate behavioral and device data.

Dropbox's Response / Official Position

Dropbox completed Apple's required privacy disclosures for its apps and maintains a public privacy policy describing the categories of data it collects; it has not disputed the label format. Developers using the Dropbox SDK were directed to Dropbox's documentation to complete their own labels.

Sources

  1. 01
    Apple — App Privacy Details on the App Store (developer overview)
    Official / Dropbox2020
  2. 02
    Dropbox — Privacy Policy
    Official / Dropbox

Related guides

Is Dropbox safe?Common questionsFull timelineBreach Tracker
Spot an error, or have a source to add?
Report an error / suggest update

Related issues

7 sources
Medium

New Terms from 1 January 2027: free accounts can be closed after 6 months idle, users must be 18+

Dropbox's revised Terms of Service, posted 1 September 2026 and effective 1 January 2027, change the inactivity test for accounts without a Paid Account from 12 consecutive months to 6, raise the minimum age to 18, and say that maintaining an account after the update takes effect means agreeing to the revised Terms. Dropbox's inactive-account help page, updated 31 August 2026, still describes a 12-month test.

Privacy & Encryption ConcernsProduct Changes & User BacklashPricing & Business Practices
Read documentation
3 sources
Medium

Seventh Circuit (2026) affirms a finding that accepting Dropbox's terms was consent to the scan that led to a criminal case; a Supreme Court petition is pending

A Seventh Circuit decision (No. 25-1536, 171 F.4th 587, 5 May 2026) affirmed a district court's finding that one criminal defendant had consented, by accepting Dropbox's terms of service, to Dropbox's review of his files, writing that "The language of this contract unambiguously permits Dropbox to scan all files at its option". A petition for certiorari (Supreme Court No. 26-460) is pending, with the government's response due 7 December 2026.

Privacy & Encryption ConcernsLegal Actions & LawsuitsGovernment Access & Surveillance
Read documentation
4 sources
Low

Dropbox's native ChatGPT integration (10 September 2026): a shipped data flow whose training and retention terms are not stated on the four Dropbox pages reviewed

On 10 September 2026 Dropbox announced, together with OpenAI, a native Dropbox experience inside ChatGPT. Users who connect their account can browse, search, @mention and preview Dropbox files there. Four Dropbox pages captured for this entry describe permissions and a per-user disconnect path, but none of them states whether content sent to ChatGPT is used to train models, how long OpenAI retains it, or any admin switch to block the connector.

Privacy & Encryption ConcernsDeveloper, API & Platform
Read documentation
3 sources
Medium

Self-serve Dash and shadow IT: an employee can wire AI into the whole company alone

Because Dash can be downloaded and set up with 'no sales or IT required,' an individual employee can connect and index an organization's apps and browser history without administrator oversight — recreating the shadow-IT data-governance risk that earlier consumer Dropbox use posed to enterprises.

Privacy & Encryption ConcernsCurrent / Ongoing Issues (2024–2026)Account Lockouts & Support Failures
Read documentation