Dropbox in 2025

Dropbox closed fiscal 2025 with revenue of about $2.52 billion, down roughly 1% year over year, paying users down to 18.07 million, and guidance for 2026 of essentially flat revenue — confirming that the core business has stopped growing even as margins expand.

After years of growth, Dropbox's paying-user count began falling and revenue turned negative year-over-year through 2025, as the company shrank managed-sales investment and exited product lines — raising questions about the durability of its core subscription business.

A federal judge compelled the users suing over the 2024 Dropbox Sign breach into individual arbitration — finding that by clicking 'I agree' to sign a document they had accepted Dropbox's terms — and then denied reconsideration, effectively shutting the class action out of court.

Beyond the headline user decline, Dropbox flagged elevated churn and downsell in its teams business through 2025 — customers cancelling or trading down to cheaper plans — a retention problem analysts called a structural drag that cost-cutting alone cannot fix.

While laying off about 20% of staff in October 2024, Dropbox was simultaneously running large share buybacks — authorizing $1.2 billion in December 2024 and a further $1.5 billion in September 2025 — directing billions to shareholders even as it cut jobs and trimmed product investment.

Following the 2024 Dropbox Sign breach, affected users filed proposed class-action lawsuits accusing Dropbox of failing to secure their data and of notifying victims too slowly. Dropbox has contested the claims, arguing the exposed data poses no identity-theft risk.

Dropbox has published a biannual Transparency Report since 2012, and its own figures document a steady, long-run climb in government and law-enforcement demands for user data — including reporting periods where US legal-process requests jumped by roughly a third.

Dropbox encrypts files at rest, but the encryption keys belong to Dropbox, not the user. This server-side model — chosen to enable deduplication, previews, and search — means the company can read user files, the root cause critics return to again and again.

With revenue flat-to-declining and its AI product Dash still showing no monetization metrics, analysts moved Dropbox to 'sell' — warning that buyback-fueled EPS masks a structurally stalled business.

ConsentFix, an OAuth-consent phishing technique first documented by Push Security in December 2025 and reported on independently through mid-2026, delivers its Microsoft 365 lures through trusted file-hosting platforms — reporting names both Dropbox and DocSend (a Dropbox company) as hosts for the password-protected files attackers use to get past mail filters.

Across multiple years, attackers have built convincing fake Dropbox login pages — reached via PDF lures and redirect chains through trusted cloud storage — to harvest victims' real business email and Dropbox credentials.

Dropbox shut down Dropbox Passwords, the password manager it had launched in 2020, in a phased 2025 wind-down ending 28 October 2025 — after which all stored credentials and payment cards were permanently deleted from its servers.

Dropbox has reorganized around Dash, an AI-powered search assistant, repeatedly describing its core file-sync product as 'mature' — leaving longtime users uncertain how much future investment the service they actually pay for will receive.

Dropbox Paper, once promoted as the future of collaborative documents, was steadily de-emphasized: docs were migrated into the ordinary Dropbox filesystem from 2019, scattering folders and breaking the app's structure, and the Paper mobile app was discontinued in October 2025.

Dropbox has staked its future on Dash, but through 2025 the AI product had not yet produced meaningful revenue offsetting the declining core — leaving analysts to question whether the layoffs-funded pivot is generating returns or simply burning the runway.

A succession of episodes — the 2023 OpenAI default-on toggle, the 2024 Dropbox Sign breach and litigation, two rounds of mass layoffs, declining users, and serial product shutdowns — has coalesced into a durable narrative that Dropbox is a fading incumbent whose trust and relevance are eroding.

Through 2025 Dropbox pushed Dash to general availability with self-serve sign-up and no IT required, marketing it as an AI assistant that indexes content across all of a user's connected apps — a model that, by design, reaches far beyond the files stored in Dropbox.

Dash connects to Google Workspace, Microsoft 365, Slack, Notion and more, and routes queries through large language models — leaving users to trust Dropbox's contractual assurances that connected and indexed data is not used to train third-party AI models.

The Better Business Bureau has logged more than 1,180 complaints against Dropbox over three years, dominated by surprise auto-renewal charges, denied refunds, and support tickets that vanish without resolution.

Because Dash can be downloaded and set up with 'no sales or IT required,' an individual employee can connect and index an organization's apps and browser history without administrator oversight — recreating the shadow-IT data-governance risk that earlier consumer Dropbox use posed to enterprises.

Dropbox's AI-powered universal search, Dash, is billed separately from storage at roughly $15 per user per month for teams and $35 per user per month for business — meaning the 'AI era' Dropbox used to justify layoffs arrives as an extra charge rather than an included feature.

A pension fund shareholder sued Dropbox and its leadership in the Delaware Court of Chancery in 2025 over the company's plan to reincorporate in Nevada, alleging the move favored controlling stockholder and CEO Andrew Houston — in what was reported as the first court challenge to Delaware's controversial SB 21 corporate-law amendments.

Independent review platforms tell a consistent story: a low ~1.9/5 on SiteJabber and a mixed Trustpilot record, dominated by complaints about surprise billing, lost files, and support that never reaches a human.

After spending about $165M on DocSend (2021) and $95M on FormSwift (2022), Dropbox discontinued DocSend's Send & Track analytics in March 2025 and began winding down FormSwift in 2025 — abandoning roughly $260M of acquisitions while citing the wind-down as a drag on its own paying-user numbers.

NCMEC's tables show Dropbox's CyberTipline reports rising from 5,113 (2019) to a peak of 54,045 (2023), then falling to 33,043 (2025). Dropbox publishes accounts disabled, appeals and reinstatement rates; the pages this archive reviewed state no review times, appeal criteria, count of automated disablings, outside review, or accuracy or error rate.

A persistent pattern of consumer complaints describes Dropbox auto-renewing annual subscriptions without clear advance notice, burying the downgrade option, and refusing refunds for unused time — practices now drawing legal scrutiny under state automatic-renewal laws.

Dropbox repeatedly assures users that AI features do not train on their data and that content is deleted within 30 days — but because these are revocable policy promises layered over server-side access rather than technical guarantees, security commentators remain skeptical that the assurances will hold.

A consumer law firm opened an investigation into Dropbox Plus auto-renewals in 2025, as strengthened automatic-renewal laws in California and New York raised the bar for consent, reminders, and easy cancellation.

Dropbox discontinued Dropbox Vault, the PIN-protected folder for sensitive files, on 4 March 2025 — automatically converting every Vault into an ordinary, un-PIN'd Dropbox folder.

Activist investor Half Moon Capital pressed Dropbox to dismantle the dual-class share structure that gives co-founder Drew Houston majority voting control, arguing that entrenched founder control and slowing growth were holding back value as the stock languished near multi-year lows.

In November 2025 Google launched a tool to move files out of Dropbox Business into Google Drive, a pointed bid to convert Dropbox customers — and a sign of how exposed Dropbox's commodity-storage business is to free, bundled offerings from far larger rivals.

Forcepoint X-Labs and The Hacker News documented a phishing campaign that used Dropbox URLs, not attachments, as the first link in a chain — ZIP to internet shortcut to .lnk to JavaScript to .BAT to a malicious Python package — that ultimately deployed AsyncRAT, Venom RAT, and XWorm via temporary TryCloudflare tunnels.

Dropbox's Terms of Service require binding individual arbitration and waive your right to join a class action — so even after a breach or billing dispute, most users cannot sue Dropbox or band together in court.

State-aligned hacking groups, including North Korea's Kimsuky and ScarCruft, have repeatedly used the Dropbox API as a command-and-control and data-exfiltration channel, exploiting the fact that Dropbox traffic is trusted and rarely blocked.

Since its 2018 IPO, Dropbox has steadily reoriented around higher-paying business customers and a 'Smart Workspace' strategy, layering price increases and feature-gating onto individual plans while shifting investment toward enterprise revenue.

Many third-party integrations request broad, full-Dropbox access rather than scoped, folder-limited permissions — so a single connected app, if compromised, can expose everything in an account.

Entangled Media sued Dropbox over two patents on cloud-based file systems; the patent office declined to review the patents, and by August 2026 the court had ruled against Entangled Media on both patents at the district-court level and called off a scheduled trial, though it remains unknown whether final judgment has been entered or an appeal filed.

Dropbox's OAuth model historically let third-party apps request full account access, and tokens persist until revoked — so a single over-permissioned or compromised integration can read, write or delete a user's entire Dropbox without any further prompt.

Dropbox's transparency reporting centers on US legal process, but as a global service it also faces foreign-government and cross-border demands — an area where its disclosures are thinner and the CLOUD Act blurs jurisdictional lines.

Because Dropbox holds the keys to decrypt users' files, a valid legal order doesn't just get a government encrypted data it can't read — it gets readable file content. The design choice is what makes lawful compulsion effective.

A persistent class of complaints describes Dropbox files that sit indefinitely in a 'syncing' state and never finish, leaving users unsure whether their data was actually uploaded — in some reported cases for months, with support unable to resolve it.

China's Great Firewall has blocked Dropbox since 2014 — at one point cutting users off from their own files overnight without warning — leaving the service reachable in the country only via VPNs that are themselves restricted.

When Dropbox cannot reconcile two versions of a file, it preserves both — saving the loser as a duplicate stamped 'conflicted copy' — a data-safety mechanism that in practice creates lasting duplication and version confusion that users cannot turn off.

Because Dropbox mirrors a permissive server namespace onto stricter local filesystems, files with disallowed characters, over-long paths, or trailing periods can fail to sync or be silently renamed — sometimes without any clear warning to the user.

Between March 2025 and April 2026 four patent-infringement complaints were filed against Dropbox in the District of Delaware, the Western District of Texas (two suits) and the Southern District of New York. Three were voluntarily dismissed by the plaintiffs within about seven weeks to three and a half months; the fourth, VE Opening, was transferred from Texas to California in July 2026 and is still open. The captured dockets do not show what any court decided on the merits; the VE Opening docket lists a motion for judgment on the pleadings and an order on it whose content was not captured.

By the end of 2025 Dropbox employed about 2,113 people — its smallest headcount since 2017, and roughly 32% below its late-2022 peak — one of the steepest sustained workforce reductions among profitable mid-cap software firms.

A June 2025 complaint in the Southern District of New York alleged that Dropbox's website was not accessible to blind and visually impaired users, in violation of Title III of the Americans with Disabilities Act. The plaintiff voluntarily dismissed the case with prejudice in September 2025; the allegations were never tested and there was no finding on the merits.

While cutting roughly a third of its workforce across three rounds, Dropbox spent heavily on share buybacks and maintained substantial executive compensation — a contrast that drew criticism over how the company allocates its gains.

Dropbox discontinued Dropbox Capture, its screen-recording and screenshot tool, on 24 March 2025 — leaving users unable to create new recordings and folding leftover content back into an ordinary Dropbox folder.

Dropbox discontinued the Dropbox Paper mobile and desktop apps on 9 October 2025, leaving the once-flagship collaborative-document product accessible only through a web browser.

Dropbox publishes no list price for its Enterprise plan, requiring buyers to contact sales for a custom quote — an opacity that lets pricing vary by negotiation and obscures the true cost of moving an organization onto Dropbox.

Dropbox has kept its free Basic plan at just 2GB since its early days, even as Google Drive offered 15GB, OneDrive 5GB, and rivals like Mega offered 20GB — leaving Dropbox with the stingiest free allowance among the major cloud providers.

Dropbox advertises Plus at $9.99 per month but charges $11.99 if you pay monthly instead of annually — a roughly 20% premium that pairs with non-refundable annual terms and auto-renewal to penalize the flexibility customers might want.

After nearly four years of litigation, a Texas jury found Dropbox did not infringe four file-sharing patents asserted by Motion Offense LLC, defeating a roughly $35 million damages demand — part of a wider patent fight Dropbox largely won.

When an account exceeds its quota, Dropbox can halt syncing — the core function users depend on — until they delete files or pay more, while the path to downgrade a plan or step back to free is comparatively buried, wrapped in loss warnings, and locked behind non-refundable annual terms.

Dropbox spent $165 million on DocSend in 2021 and $95 million on FormSwift in 2022, promising to weave them into an 'end-to-end agreement workflow' — continuing its pattern of acquiring standalone tools whose long-term integration and survival under Dropbox is uncertain.

Dropbox Sign (formerly HelloSign) is sold as a wholly separate subscription — a free tier capped at three documents per month, then Essentials at about $15, Standard at about $25, and Premium at roughly $40 per user per month — so existing Dropbox storage customers must pay again, per seat, to sign documents.

Dropbox made remote work a permanent default in 2020 and marketed 'Virtual First' as a model employer policy — but the lived reality of converted offices, evolving expectations, and culture-by-Slack drew its own employee friction.

Users have long complained that Dropbox badgers them with upgrade prompts, full-page upsell interstitials, in-app badges, and marketing emails — pressure that hits not only free accounts but, by users' accounts, paying Professional customers too.

Topia Technology sued Dropbox and other cloud-storage companies over two file-synchronization patents; rather than fight in court, Dropbox and Box challenged the patents at the Patent Trial and Appeal Board, which found the claims unpatentable — a result later affirmed by the Federal Circuit.

Dropbox launched a zero-knowledge password manager in 2020, but reviewers and privacy advocates questioned trusting a vault to a company that — for its core product — holds the encryption keys and has a documented history of breaches.

Dropbox Transfer lets users send files via a link, but its meaningful size limits are gated by tier: free Basic and entry plans are capped at 2 GB per transfer, with the headline 100 GB (and 250 GB with a Replay add-on) reserved for higher-priced business tiers.

To comply with US trade sanctions and embargoes, Dropbox does not provide service in regions such as Crimea, North Korea, and Syria — meaning users there can be cut off from their existing files by their provider's home-country law.

Names that are distinct on Dropbox's case-sensitive, Unicode-tolerant servers but identical on Windows or macOS collide on sync, and Dropbox resolves the clash by silently appending '(Case Conflict)' or '(Unicode Encoding Conflict)' to one of the files.