A widening privacy policy: data flowing to Google, Amazon, OpenAI, Stripe and more

Dropbox's privacy policy and data practices have broadened over the years as the company added analytics, advertising/marketing, AI, and payments capabilities. In February 2024, Proton published a detailed critique ('We took a dive into the Dropbox privacy policy — it's not good') concluding that, while Dropbox says it does not sell data to advertisers, the policy permits sharing personal information with a range of named third parties including Google, Amazon, OpenAI, Kissmetrics, and Stripe.

Proton also highlighted that Dropbox keeps 'a record of practically anything you could do with a file' — creating, editing, sharing — and that the company says it may disclose user data to law enforcement based on its own judgment, including where it believes disclosure is in the 'public interest,' a phrase Proton called 'so vague it can be used to justify any kind of situation.' Because Dropbox decrypts files to provide its features, this all rests on the company's server-side access to user content. These are characterizations of Dropbox's stated policy by a competitor; the policy language is public and Dropbox frames its data use as service-related.

Two other Dropbox texts, one last updated in April 2024 and one posted in September 2026, bear on the same question. Dropbox's Privacy Policy FAQ ("Updated Apr 08, 2024") says: "We may build models that identify keywords and topics from a given document. These models may be trained on your documents and metadata, and power features within Dropbox such as improved search relevance, auto-sorting and organization features, and document summaries." The FAQ does not describe those models as generative. The revised Privacy Policy, posted 1 September 2026 and effective 1 January 2027, adds the sentence "Please see our FAQ for more detail regarding how Your Stuff may be used to improve the Services." It also says team administrators "may be able to view changes in account state for your other accounts, such as suspension, deletion, termination, account capture, or removal from another Dropbox Team," and adds an appeal route: "please email us at [email protected]". Dropbox's help page on the updates, answering a question about how data is used or shared, says: "For many users, these updates do not change how your data is used or shared, as they only clarify or better explain our existing handling of your data." This archive does not treat the new pointer as a new data use; it records that the added sentence points to that FAQ, which the current Privacy Policy already cites, including for how Dropbox uses artificial intelligence and machine learning.