Terms, privacy & compliance

A phishing campaign impersonating the CI provider CircleCI tricked Dropbox employees into handing over credentials and 2FA codes, letting attackers copy 130 of Dropbox's private source-code repositories.

Dropbox's revised Terms of Service, posted 1 September 2026 and effective 1 January 2027, change the inactivity test for accounts without a Paid Account from 12 consecutive months to 6, raise the minimum age to 18, and say that maintaining an account after the update takes effect means agreeing to the revised Terms. Dropbox's inactive-account help page, updated 31 August 2026, still describes a 12-month test.

A Seventh Circuit decision (No. 25-1536, 171 F.4th 587, 5 May 2026) affirmed a district court's finding that one criminal defendant had consented, by accepting Dropbox's terms of service, to Dropbox's review of his files, writing that "The language of this contract unambiguously permits Dropbox to scan all files at its option". A petition for certiorari (Supreme Court No. 26-460) is pending, with the government's response due 7 December 2026.

On 31 January 2024 Dropbox corrected the "individual pieces of content actioned" figure in its published child-sexual-abuse-material enforcement reports for four half-years (2021–2022): 2,221,782 as first published became 975,919, with the worst single period overstated 6.4×. The CyberTipline report counts and account counts were not restated.

Dropbox's Terms of Service require binding individual arbitration and waive your right to join a class action — so even after a breach or billing dispute, most users cannot sue Dropbox or band together in court.

Dropbox's transparency reporting centers on US legal process, but as a global service it also faces foreign-government and cross-border demands — an area where its disclosures are thinner and the CLOUD Act blurs jurisdictional lines.

A June 2025 complaint in the Southern District of New York alleged that Dropbox's website was not accessible to blind and visually impaired users, in violation of Title III of the Americans with Disabilities Act. The plaintiff voluntarily dismissed the case with prejudice in September 2025; the allegations were never tested and there was no finding on the merits.

A July 2011 terms-of-service and privacy-policy update used broad licensing language that many users read as Dropbox asserting ownership-like rights over their files, forcing the company to publicly clarify and walk back the wording.