Data Report Card · Dropbox
Dropbox Data Report Card
A
11/12 Policy grade · Cloud storage · Dropbox, Inc.
Reviewed Jun 2026 · policies are checked weekly for changes · stated — every cell is read from Dropbox's published policy; none has been tested (run by us) yet.
2Accessstated
Dropbox lets you submit a data access request from the Privacy tab in account settings and download a copy of your personal data, satisfying the access right.
Dropbox — Privacy Policy FAQ (access request) · accessed Jun 2026 ↗2Portabilitystated
Dropbox provides your data in a machine-readable format through in-product export tools and a full OAuth REST API (JSON), and cites the EU Data Act export path, meeting the multi-format machine-readable bar for full portability.
Dropbox — EU Data Act Information / API export · accessed Jun 2026 ↗Connects to apps: Yes. Dropbox offers a full OAuth 2.0 REST API a consumer can grant to an app, with short-lived access tokens plus long-lived refresh tokens (
token_access_type=offline) and revocation from account settings, so agent access is scored at the full level. Dropbox — OAuth Guide (refresh tokens) · accessed Jun 2026 ↗2Frictionstated
Access, export, and deletion are all self-serve from the Privacy tab (no email required) and additionally scriptable via the API, placing friction at the low level.
Dropbox — Privacy Policy FAQ (Privacy tab) · accessed Jun 2026 ↗2Deletionstated
You can delete your account and data self-serve; file deletion is initiated after 30 days, with limited legal-retention and backup-latency caveats, so deletion is scored at the full level.
Dropbox — Privacy Policy (deletion, 30-day) · accessed Jun 2026 ↗2Sells / sharesstated
Dropbox’s privacy policy states: "We may share information as discussed below, but we won’t sell it to advertisers or other third parties." The sentence is unchanged in the version taking effect 1 January 2027, so selling is scored at the full level.
Dropbox — Privacy Policy, With Whom ("we won’t sell it") · accessed Jun 2026 ↗1Trains AIstated
Dropbox uses machine learning and may train models on your documents and metadata to power features like search and summaries, and shares content with third-party AI partners (e.g. OpenAI); both are opt-out rather than opt-in, though Dropbox pledges no generative-AI training without consent, so model-training use is scored at the partial level.
Dropbox — AI Principles / third-party AI opt-out · accessed Jun 2026 ↗Reviewed Jun 2026 from Dropbox's Privacy Policy, Privacy FAQ, and AI Principles / opt-out help pages. All cells are "stated", not tested. Dropbox scores strongly: self-serve access, machine-readable export plus a full OAuth API, self-serve deletion, and a plain "we won't sell your data" commitment. The single blemish is AI — Dropbox trains machine-learning models on documents and metadata for features like search and summaries and shares content with third-party AI partners (opt-out, not opt-in), which is scored at the partial level.
Events
Breaches, policy changes, and export-format changes we’ve recorded at Dropbox — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for Dropbox.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
15 Oct 2026Sells / shares your datanote
Score unchanged (2). The cell quoted wording (“we won’t sell your data or information to advertisers, third parties, or anyone else”) that appears on no current Dropbox page. It now quotes the policy’s own sentence: “We may share information as discussed below, but we won’t sell it to advertisers or other third parties.” The same sentence appears in the policy taking effect 1 January 2027.
Dropbox — Privacy Policy, With Whom ↗How to request your data from Dropbox
- Go to https://www.dropbox.com/privacy — Dropbox's data-request entry point.
- Account settings -> Privacy tab: data access / export / deletion request; full OAuth REST API; privacy@dropbox.com.
- Expected wait: self-serve Privacy tab for access / machine-readable export / deletion; file deletion initiated after 30 days; OAuth API export available — Dropbox's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Dropbox — Privacy tab (account settings): mailto:privacy@dropbox.com.
These steps reflect Dropbox's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.