Skip to main content
Dropbox logo

Dropbox

Based exclusively on public evidence • 20 criteria (Privacy + AI)
Last review: 13 Feb 2026

B-
AITS IA
Privacy Rating by TrustThis — Verified Seal

AI Trust Summary

AI Training
Training policy documented
Data Retention
Partially mentioned (no defined period)
Opt-out
Only generic controls (cookies, ads)
AIPrivacy
B-
BasePrivacy
B+

Safer Alternatives

Higher-rated software in the same category

See Full Alternative Comparison

Compliances in AI (3)

AI criteria the company meets. Buy the Premium Analysis to see all 3 criteria.

AI features clearly identified with their purposes

Automated AI decisions explained in an understandable way

Use of artificial intelligence clearly disclosed in policies

Source: vendor public documents

Highlights in Privacy (3)

Most relevant criteria for this category. Buy the Premium Analysis to see all 3 criteria.

Legitimate interest does not explain rights balancing

Data controller identity and contact clearly disclosed

Data controller and processor roles clearly defined

Source: vendor public documents

Conformance analysis (20)

Premium Feature
AITS Criterion 10
Compliant

Data controller identity and contact clearly disclosed

Reference: ISO/IEC 27701 (7.3)

AITS Criterion 9
Compliant

Data controller and processor roles clearly defined

Reference: ISO/IEC 27701 (7.3)

AITS Criterion 12
Compliant

Processing purposes clearly listed by data category

Reference: ISO/IEC 27701 (7.3)

Source: vendor public documents

Follow this company and access all 20 criteria

Track score changes, get alerts on policy updates, and view the full conformance analysis

Sign up free

Don't miss any update

Sign up to follow this company and track changes in privacy and AI scores

Sign up free

Why trust the AITS Index: Open Community Audit

Public transparency, peer review and open evidence trails — all verifiable by the community

Trust guarantees

Peer review

users, professionals and experts confirm or contest items online.

Public history

vendor and index changes are versioned and accessible.

Participate

Evidence, confirmations and contestations

participate in the collaborative validation of AITS criteria

Contact us

Dropbox Privacy and Security: Strengths, Weaknesses, and Practical Guidance

Transparency in Data Processing Purposes

Dropbox excels in transparency regarding the purposes of data processing. With a strong emphasis on clearly listing the purposes for which user data is collected, Dropbox ensures that users are informed about how their information is utilized. This transparency is crucial for users who want to maintain control over their personal data. The clarity in data processing purposes contributes positively to the overall user experience, allowing individuals to make informed decisions about their data sharing practices.

Clear Identification of Data Recipients

Another strength of Dropbox is its clear identification of data recipients in its privacy policy. Users can easily find out who their data is shared with, which enhances trust in the platform. Knowing the entities that have access to personal information allows users to assess potential risks and make educated choices about their data. This aspect of Dropbox's privacy practices scores well and reflects a commitment to user rights under regulations such as GDPR and LGPD.

Lack of Balance in Legitimate Interests

Despite its strengths, Dropbox has notable weaknesses, particularly regarding the use of legitimate interests. The platform does not adequately explain how it balances user rights with its commercial interests. This lack of clarity can lead to user distrust, as individuals may feel their rights are not being prioritized. Users should be aware that while Dropbox may have legitimate reasons for processing data, the absence of detailed explanations can create uncertainty about how their data is being handled.

Insufficient Safeguards for Sensitive Data

Another significant concern is the lack of documented safeguards for the processing of sensitive data. This shortcoming is particularly critical for users who handle sensitive information, as it raises the risk of data breaches and misuse. Users should exercise caution and consider implementing additional security measures, such as encrypting sensitive files before uploading them to Dropbox. This proactive approach can help mitigate potential risks associated with inadequate safeguards.

Practical Guidance: Settings to Check

To enhance privacy while using Dropbox, users should regularly review their account settings. Enabling two-factor authentication is a crucial step in securing accounts against unauthorized access. Additionally, users should familiarize themselves with the sharing settings for files and folders, ensuring that they only share information with trusted individuals. Regularly auditing shared links and permissions can further protect sensitive data from unintended exposure.

Alternatives and Precautions

For users concerned about the weaknesses identified, exploring alternative platforms with stronger privacy practices may be beneficial. Consider solutions that provide more robust safeguards for sensitive data and clearer explanations of how user rights are balanced. Furthermore, users should stay informed about their rights under GDPR and LGPD, ensuring they can exercise their data protection rights effectively. By being proactive and informed, users can navigate the privacy landscape more safely while using Dropbox.

Other Communication and Collaboration software

Dive into in-depth research and analysis of each player

Source: vendor public documents

Evidence, confirmations and contestations

participate in the collaborative validation of AITS criteria

Contact us

Scope & Limitations

TrustThis/AITS assessments are based exclusively on publicly available information, duly cited with date and URL, following the AITS methodology (privacy & AI transparency).

The content is indicative in nature, intended for screening and comparison, not replacing internal audits.

TrustThis/AITS does not perform invasive tests, does not access vendor technology environments and does not process customer personal data. Conclusions reflect only the vendor's public communication at the date of collection.

Source: vendor public documents