What is The Non-Consensual Cookie Bandit?

A satirical web experience that parodies cookie consent popups by "auditing your life" instead of tracking your data. It's a humorous exploration of digital consent culture.

Is this actually tracking my cookies?

No. Despite the name, we don't actually track cookies in the traditional sense. This is a parody project that uses "cookies" as a metaphor for life decisions.

Is the life audit real?

The audit is generated for entertainment purposes only. Results are satirical and should not be taken as genuine life advice.

Can I play games on this site?

Yes! We have several mini-games including the Reject Button Game and Cookie Clicker. More games are being added regularly.

Is my data being used to train Grok?

By default, yes. X added an option to opt out located under Settings > Privacy and Safety > Grok. At the time of its introduction, opting out required navigating to a settings menu that most users do not visit. The default was "opted in." The Bureau notes this is the textbook definition of a dark pattern.

Can X read my direct messages?

X does not offer end-to-end encryption for standard direct messages. X employees and systems can access DM content for purposes including safety review, legal compliance, and as of the current policy, potentially other purposes. Encrypted DMs were introduced as a feature but remain opt-in and limited.

What happened to Twitter's privacy commitments after the acquisition?

In 2022, Twitter had an FTC consent decree in place following a 2011 settlement, requiring certain privacy practices. In 2023, under new ownership, Twitter/X was fined $150 million for violating that consent decree by using phone numbers collected for security purposes for targeted advertising. The Bureau considers this factual context rather than editorial commentary.

← Hall of Shame

D-

Twitter / X

social-mediabiometricai-trainingpolicy-instabilitysurveillance

4,700

Word Count

19 min

Reading Time

0 min

Human Patience

9/10

Sneakiness

Translation Service

What They Say

Twitter/X's privacy policy, substantially rewritten since the 2022 acquisition, describes a platform committed to open exchange and user safety. The policy explains data collection as necessary for the platform's operation, advertising, and safety systems. Under Musk-era additions, the policy also explains that X may collect biometric data for safety and identity verification, and that user data may be used to train X's artificial intelligence systems, including the Grok chatbot.

What They Mean

The current X privacy policy represents a significant expansion of data collection from the Twitter era. The biometric data provision — added in 2023 — allows collection of facial geometry from ID verification. The AI training provision — the default opt-out of which was initially buried under Settings > Privacy and Safety > Grok — means that your tweets, replies, and engagement data are used to train a commercial AI product. The policy has been updated four times in 24 months, each update quietly expanding what X can do with user data. The Bureau recommends checking it quarterly.

Worst Clause — Exhibit A

"We may offer features that help users identify their real identity on our platform or that help keep our platform safe. We may collect and use your biometric information for safety and security purposes. We may also collect your employment and education information."

Bureau Translation:

"May collect" means they have reserved the right. The safety and security framing is doing political work — it positions biometric data collection as protective rather than commercial. There is no specific limitation on how long biometric data is retained or what happens to it if X is acquired. The phrase "help users identify their real identity" is a description of an anti-anonymity system that is written to sound like a feature.

Evidence Tags — Data Collected

All posts, likes, follows, and interactionsDirect message content (accessible to X under certain conditions)Biometric data and government ID (for verification)Location from IP, GPS, and inferred from contentPayment information for subscriptions and tippingEmployment and education data (voluntary)All data used to train Grok AI by default

Bureau Verdict

"Twitter/X receives the Bureau's D- for a policy that has been revised more frequently than most companies update their products, with each revision consistently expanding data rights rather than limiting them. The addition of biometric data collection and AI training provisions without prominent user notification in 2023 is the specific cause for the minus. The Bureau will continue monitoring this policy on a quarterly basis, which is how often it changes."

D-

Overall Grade

Changed Recently (Red Flag)

Frequently Asked Questions

Dark Patterns Documented

Misdirection →Roach Motel →Bait and Switch →

See the full Dark Pattern Encyclopedia for documentation of each technique.

← All Companies Dark Pattern Encyclopedia →Terms Nobody Read →

Audited: 2026-03-15