Yes, Twitter Scans Your Private Messages, But Did The Company Properly Disclose It?

Private messages on Twitter aren't entirely private; a computer scans them and converts links to Twitter's proprietary t.co format. A recent class action lawsuit charges that Twitter hasn't been entirely straight about this with users.

The lawsuit, filed in San Francisco, takes issue with the company promoting direct messages as a way to “talk privately” while it simultaneously scans and alters those messages. No humans are directly involved, and it’s not about the text, but computer algorithms do alter the links sent via direct messages.

“As soon as a user sends a direct message, Twitter intercepts, reads and, at times, even alters the message,” the case reads. “For example, should a user write a direct message and include a hyperlink, Twitter's algorithms will read through the direct message, identify the hyperlink, and replace it with its own custom link.”

Twitter, for its part, doesn't think there's anything to worry about. In a statement provided to International Business Times, the company wrote, “We believe these claims are meritless and we intend to fight them.”

A law professor in an interview with USA Today seems to think there's little chance of the claim succeeding. Ryan Calo of the University of Washington pointed to an algorithm altering links as similar to other automated programs scanning for spelling errors or for advertisement potential, as Google does.

Private messaging scanning has been happening for awhile at Twitter. It used to be that direct messages were limited to 140 characters, and Twitter had a URL shortener that immediately shortened the link, with no way to turn it off. But even with Twitter having lifted the character limit, the technology still exists. While it doesn’t visibly shorten the link, each URL is still redirected.

Twitter explains that feature. Go to t.co, and you’ll see a message that reads, “Twitter uses the t.co domain as part of a service to protect users from harmful activity, to provide value for the developer ecosystem, and as a quality signal for surfacing relevant, interesting Tweets.”

And Twitter’s terms of service also note that these exist: “We may modify or adapt your content in order to transmit, display or distribute it over computer networks and in various media and/or make changes to your content as are necessary to conform and adapt that content to any requirements or limitations of any networks, devices, services or media."

The word “content” in the terms of service is defined as “any information, text, graphics, photos or other materials uploaded, downloaded or appearing on the Services.” The section doesn’t specifically call out “Direct Messages,” nor does it distinguish between public or private messages in its altering.

The lawsuit points to how Twitter defines its Direct Messages as private in several other places, however. One section pulls from the description on a support page titled “About Direct Messages.” The page starts with, “Direct Messages are the private side of Twitter. You can use Direct Messages to have private conversations with Twitter users about Tweets and other content.”

Snapchat, the popular disappearing photo- and video-messaging app, faced a similar suit in 2014 for its marketing of privacy to users. The Federal Trade Commission had taken the case and put forth that the company had several "misrepresentations to consumers about its product" that went against "how the app actually worked," the press release read. That case led to Snapchat altering the language of its terms of service and eliminating the "disappear forever" pitch.

“If a company markets privacy and security as key selling points in pitching its service to consumers, it is critical that it keep those promises,” FTC Chairwoman Edith Ramirez said in a statement regarding Snapchat's case. “Any company that makes misrepresentations to consumers about its privacy and security practices risks FTC action.”

The class action suit against Twitter is charging the company with “unlawful conduct” that violates the Electronic Communications Privacy Act and the California Invasion of Privacy Act.

Here’s the case in its entirety:

Twitter Eavesdropping Class Action