Issues Database

Italy's competition and consumer authority opened proceedings against Dropbox in 2020 over its cloud-storage terms; in 2021 it closed one case after Dropbox committed to clearer disclosures and, in a second, found several contract clauses unfair and ordered their removal — in both cases without a fine on Dropbox.

Dropbox replaced its coarse legacy access types with granular OAuth scopes, requiring every developer to revisit their app's permissions in the developer console and, in many cases, have existing users re-authorize before new functionality would work.

The DropSmack proof-of-concept warned that synced Dropbox folders could be a covert C2 and exfiltration channel; multiple real malware families — including BoxCaon, Crutch and tooling used by Kimsuky — went on to abuse Dropbox folders and the Dropbox API exactly that way.

In January 2021 Dropbox laid off about 315 employees — roughly 11% of its workforce — and announced the departure of its COO, framing the cuts as necessary to streamline the business even as the company was profitable and demand for remote tools was surging.

Topia Technology sued Dropbox and other cloud-storage companies over two file-synchronization patents; rather than fight in court, Dropbox and Box challenged the patents at the Patent Trial and Appeal Board, which found the claims unpatentable — a result later affirmed by the Federal Circuit.

Users have long complained that Dropbox badgers them with upgrade prompts, full-page upsell interstitials, in-app badges, and marketing emails — pressure that hits not only free accounts but, by users' accounts, paying Professional customers too.

Dropbox went 'Virtual First' in 2020, making remote the default and converting offices to drop-in studios — but the shift, layered on a record 2017 San Francisco headquarters lease, drove hundreds of millions in real-estate impairment charges, including roughly $400M+ tied to subleasing its HQ.

Dropbox made remote work its permanent default in 2020 and took significant real-estate impairment and restructuring charges as it closed and subleased offices.

European courts and regulators treat data held by US providers as inherently reachable by US surveillance under FISA Section 702 and the CLOUD Act — a structural concern that applies to any US-controlled cloud service, including Dropbox, regardless of where servers sit.

Dropbox launched a zero-knowledge password manager in 2020, but reviewers and privacy advocates questioned trusting a vault to a company that — for its core product — holds the encryption keys and has a documented history of breaches.

Dropbox launched 'Spaces' in 2019 as the new identity for its workspace app, relaunched it as 'Spaces 2.0' in a 2020 beta, and then quietly dropped the Spaces branding — the workspace ambitions folded back into the ordinary Dropbox app.

When the EU's top court struck down the EU–US Privacy Shield in 2020, Dropbox — which had self-certified under the framework — was among the US cloud services left exposed to European data-protection regulators questioning whether personal data could lawfully be transferred to the United States.