Cross-Border Data Transfers: Where Your Old Tweets Get Legal Protection

When you delete old tweets, you rarely ask one question: whose servers hold this data, and which laws protect it? That question decides how much real control you have when you "request deletion". X is a US company processing data mainly in the US, but it operates worldwide, and the law that applies to you changes by location.

Data sits in the US, but rights follow you

X's servers and parent company are mostly in the US, and the physical processing is likely there too. But privacy protection is not only about server location; it is about which jurisdiction you, the user, sit in. Scroll X from the EU and the GDPR applies to you; from California and CCPA/CPRA applies. In other words, your rights follow your jurisdiction, not the data center.

Four main jurisdictions differ

Jurisdiction	Core right	Enforcement
EU (GDPR)	Erasure, portability, access	High fines, ~1 month response
UK (UK GDPR)	Close to EU model	UK regulator
California (CCPA/CPRA)	Access, delete, opt out of sale	Private right of action
Other regions	Local law or contract	Varies widely

What this means in practice

First, when you file a deletion request in your jurisdiction, the platform is legally obliged to respond, but enforcement speed and scope vary. The EU right to erasure is the strongest; platforms usually must answer within a month. California's deletion right is also explicit but focuses more on "you can see what the platform collected". Second, platforms use mechanisms like standard contractual clauses for cross-border transfer; that covers transfer compliance, not absolute safety of your data. Third, the most reliable step is to clean the source: rather than wait for the platform to slowly process a request, delete your high-risk tweets first.

How far a request actually reaches

The law gives you the right to ask the platform to delete personal data under its control, but several categories often fall out: records it must keep for compliance, copies scraped by third parties and redistributed, and content you reposted or commented on elsewhere. So the law is a tool, but it does not cover every corner. For the concrete steps, see how to file a GDPR deletion request with X.

Do not bet everything on the law

Regulations give you a tool, but response cycles are long and scope is limited. Archived content and copies scraped by third parties often fall outside a platform's one-click deletion. The step you actually control is from your own account: clear high-risk items like phone numbers, home addresses, and locations first. Back on the homepage, filter by risk label with our on-device tool; it is far faster than waiting on a cross-border legal process.

A reminder: jurisdiction is not your choice

Some assume "I am in China, so the GDPR does not apply to me". In practice the law looks at where the platform serves you, your usual residence, and the features you actually use. Where you are and which region your account binds affect how rights land. So do not bet that a platform will always follow one country's law; the safest move is still to clear high-risk content yourself first. For a concrete request template, see the GDPR deletion request template.

What to do while the law moves slowly

Legal requests can take weeks, and during that window your old posts stay live. Use the wait to shrink your surface: delete posts with your home city, workplace, and any family details, since those are what brokers and background checks look for first. Treat the legal route as a backstop, not your first move. When the request finally processes, you will have already removed the items most likely to cause harm, so the slower path matters less. This two-track habit keeps you safer than relying on any single method.