Dropbox: How to opt out of 3rd party AI partner access to your Dropbox

For people who can't or won't access Twitter, the setting for individual accounts is here:

https://www.dropbox.com/account/ai

and the setting for team accounts in the admin console is here:

https://www.dropbox.com/team/admin/settings/ai

Ours (for a US business account) was on by default. The text for the setting is:

Let team members use artificial intelligence (AI) so they can work faster in Dropbox. We only use technology partners we have vetted. Your organization’s data is never used to train their internal models, and is deleted from third-party servers within 30 days.

There's a "learn more" link that goes here:

https://help.dropbox.com/view-edit/privacy-settings-dropbox-...

Dropbox claims that they "won’t let our third-party partners train their models on our user data without consent". The page further claims that the participation option is on by default for teams "participating in the Dropbox AI alpha", but I don't think we signed up for any such thing and the option was still on for us. I checked the settings and we are not currently enrolled. I have zero confidence that "consent" to use our data for model training won't also default to opt-in.

The page further states that Dropbox currently has one AI partner -- OpenAI.

I see no such setting, for my free personal account which is currently overfull and not syncing due to having previously had some temporary promotional space above my current limit. Is this setting not present for everyone? If relevant, I am currently in Germany, although my account was created in either the US or Canada (I forget which).

I'm in UK and I also don't have it.

I suspect there is a Great Deal of Precautionary Rationale (eh) protecting the Eurosphere from the worst privacy abuses.

In the Twitter post the OP says he is based in the EU.

Oddly enough, I am in the UK - and I do have it, but it was already turned off when I went there. I wonder if things have changed, or there are some canary releases of the box... or am I just completely unaware my account isn't considered a UK-based account?

I’m in the UK and I can see it. It was off.

I'm in the US and don't see it either.

I'm in the U.S. and don't see it on my free account either. I also don't have early access features turned on, so I wonder if it could be related to that. [Or, as is mentioned in some other comments, maybe free accounts don't have the option because they can't access AI powered features.]

Same here.

To be fair to Dropbox that page also states:

"Your files within Dropbox are sent to a third-party AI only when you chose to interact with AI powered features. For example, when you ask a question about a file. "

"If you or your team is participating in the Dropbox AI alpha, the Third-party AI toggle in your account settings is turned On by default. Only the content relevant to an explicit request or command is sent to our third-party AI partners to generate an answer, summary, or transcript."

Basically, its saying "if you use AI tools, we'll send your data to a 3p, but if you don't, we're not".

The issue really is if they turned on a feature in the future "ask a question about this document" and you didn't know it meant that the document was sent over to OpenAI.

"If you or your team is participating in the Dropbox AI alpha, the Third-party AI toggle in your account settings is turned On by default. Only the content relevant to an explicit request or command is sent to our third-party AI partners to generate an answer, summary, or transcript."

It turns itself back on??? So, what's the point of the toggle then?

False sense of privacy. Dropbox didn’t have the best history in keeping your files private

It has to be on initially for later plausible denial..

I can’t seem to find this setting. Is it getting rolled out slowly?

In Canada, I also couldn't find this setting.

I'm in Canada and I had it. I'm on a paid account.

I stopped paying a long time ago before actually deleting my account today. So maybe the setting was implicitly turned on for non-paying customers. Wouldn't surprise me.

In the US, not seeing this either. I do have a free account though, not sure if that makes a difference.

Try going to your account then from the menu go to Settings > Third-party AI

Heres what the link looks like for me in the US: https://www.dropbox.com/account/ai

Paid subscribers can see it in US, not sure whether it depends on the subscription tier though.

Im in the Netherlands and also dont see the setting. Using a basic (free) account.

I'm in the US on a paid account and I had it.

Not in Turkey either.

US here, I can't see it either. I noticed the tweet mentions European Data Protection Supervisor (EDPS), is this EU only?

I don't have it (from EU), so this may be limited to a subset of users, but in any case I believe that it would have to be opt-in for EU users.

My company is in the US. I just checked and found that we have the setting in our admin console and it was on by default. We do have a paid business account.

Nitter link: https://nitter.net/Werner/status/1734890651378975007

It took a while, but the arc of history is starting to bend in favour of that guy who said 'just use rsync' on Drobox's Show HN post in 2007.

What are you talking about? They have almost 20M paying users for a reason. Good luck asking all people in your company to use rsync.

He's talking about the fact that those people don't need to worry about third parties accessing their files without their consent.

I guess that depends on where you are rsync-ing to?

I'd still assume that the bulk of Dropbox users are the kind who wouldn't want to figure out `rsync`.

For better or worse, even enough grad students at MIT (which used to be one of the more computers-clueful places) used Dropbox so heavily that they included the Dropbox logo on the grad class ring:

https://thetech.com/2013/09/06/gradrat-v133-n35

The class rings have considerable symbolism, and are very important to some. I've heard that the rings can also be real icebreakers at some startup events (between people with MIT connections):

https://en.wikipedia.org/wiki/MIT_class_ring

I'd still assume that the bulk of Dropbox users are the kind who wouldn't want to figure out `rsync`.

That's because OS's don't bother to support rsync with good UX. That's what the old "My Briefcase" feature in Windows 9x was all about. It even had special-case support for difference merging (or "reconciliation") which rsync alone doesn't quite provide.

Average users don't want to figure anything out: adblockers, torrents, cloud sync, you name it.

It's only when they get screwed by the vendor that they realize that having a non-commercial, non-enshittified alternative is crucial to counterbalance tech company malfeasance.

It was FTP [1]. If only he had said rsync, we wouldn't be here now /s

[1] https://news.ycombinator.com/item?id=9224

rsync doesn't offer AI capabilities. If you want to roll your own integration with OpenAI then you will still be sending data to OpenAI.

It took a while, but the arc of history is starting to bend in favour of that guy who said 'just use rsync' on Drobox's Show HN post in 2007.

It be interesting to see a breakdown on "time spent" between the people who went with Dropbox and started syncing stuff right away VS the people who first setup their own infrastructure to do the same thing.

rsync ... to where? You need to rent a server first. And to do that you need a credit card. And if you die, said credit card gets canceled, as is your server, as is all your data. Happened to me with a paid Dropbox account - card expired, all data lost. A free Dropbox account has an advantage that it is good for eternity (well, not a guarantee, but a reasonable assumption). Also good for privacy.

I do rsync too (robocopy, to be exact), and I prepaid the server for 2 years, but still, dropbox plays an important role in ensuring longevity of my data.

Doing this without opt-in should be illegal.

We need blanket minimum privacy protections at a national level, and they should treat internal repurposing of data the same as third party sharing.

Since all major players in our industry have shown they can’t be trusted to curate large collections of sensitive data, inclusion in such internal datasets should be opt in as well.

Dropbox is a poster child for “this should be E2E encrypted”, so, yes, I’m arguing they should get your explicit opt-in before they are allowed to store unencrypted data or escrow keys on their end, and that the opt-in shouldn’t be required to use their services.

Dropbox is a poster child for “this should be E2E encrypted”

how would you implement some very trivial features like even being able to search though

At least basic encryption. Remember one day, Dropbox forgot in production to check passwords of users. So you only had to enter email to access the Dropbox of the user (an open "log as" feature).

Thats crazy, do you know if there's an article about Dropbox breaking auth? Don't remember hearing about it.

https://www.cnet.com/news/privacy/dropbox-confirms-security-...

Or the time when they simply sent your complete file structure to some random company without any consent or information?

What do you mean by "basic encryption". Either dropbox could access our files or it couldn't without authentication from us. If it couldn't how would search or indexing work.

we've implemented E2EE search (and pretty much every feature you would expect) on https://skiff.com/drive

are you pledging to make every new feature that's ever developed opt-in on risk of jail time for you personally?

I've used Dropbox for 13 years and I have never noticed that they have a cloud search feature, nor have I ever needed that. It syncs to my machines where I have my local search working in the exact same manner as for non-Dropbox data - why does Dropbox need a special search, one where they would search my unencrypted data?

If you click the setting to 'off' you are making the assumption that your stated desire will be honored and that there won't be another move like that in the future. The better move would be to stop using Dropbox, that way you are really sure that your files won't be accessed by unauthorized parties.

I really don't get what drives companies like Dropbox to throw their carefully built up reputation under the bus like this.

Greed.

If true: what does OpenAI pay dropbox for access to their customers' files? And what kind of guarantees are there that OpenAI stays within the lines, because all of these AI companies are looking for as much non-AI tainted data as they can get their grubby little fingers on for training purposes.

It's possible OpenAI doesn't get any money; and they just provide whatever "AI service" is being requested of them, and returns the results to Dropbox.

And, well, if OpenAI just happens to gain access to a trove of data by providing the service... ¯\_(ツ)_/¯

All this setting does is make the feature available to you in the frontend -- it's up to you to use it or not!

How do you know that? You can't because Dropbox doesn't say

Or do I…

Companies like Dropbox see reputation as capital. Keep a little, but spend most of it on growth.

Most laypeople have no idea what any of this means, and that's if they even hear about it at all.

The tech community that's clued into this is such a small percentage, unfortunately.

Funny anecdote: remember when those "I do not consent to facebook using my data" messages that were, ironically, posted to people's facebook walls?

It's not at all strange to me that Dropbox deployed this dark pattern. What really stood out to me is that, this post was made by the CTO of Amazon.

did I agree to this somewhere?

The CTO of Amazon uses Dropbox?!

Amazon has no competitive consumer product to dropbox, and he rightfully might want to separate his work and personal data. Can't really expect one to use S3 as a dropbox replacement.

Does Dropbox not use S3 as its backend? I would not be shocked to learn that it does

absolutely not: https://www.infoq.com/articles/dropbox-magic-pocket-exabyte-...

perhaps you should be a little shocked to hear if they are using s3(they are not). s3 is awesome but it's not supposed to be used absolutely everywhere.

Whether dropbox uses S3 or not is irrelevant. Dropbox and equivalents are much higher level products not replaceable with an object store.

He is the CTO. He is in charge of Amazon Drive. He has the authority to implement any missing feature for his use-case.

Yes and as the CTO it is better to understand what products make sense for Amazon customers and implement those, instead of what he wants to use personally.

Just checked my account and this option was on. Turned it off but it's completely unacceptable that it was on in the first place. If anyone has any good alternatives please let me know. Preferably encrypted options.

I've been looking at options, and while mega seems good they also seem to happily hand over your data to authorities, which means it's not really encrypted, or might as well not be.

I've seen skiff shilled a few times here and on the twitter thread but the website is too annoying for me lol.

Currently thinking I'm going to mess with filen.io tonight. It has a linux client and is e2e encrypted. Still looking and open to suggestions though.

The e2ee is opt-in, so that might be how they comply with subpoenas. I like that it's on all the platforms I am.

:'(

syncthing. Open source, e2ee, and doesn't rely on some morally compromised "venture".

There are some options:

Mega.io

Proton Drive

Rclone to your own encrypted bucket

Mountain Duck / Cloud Mounter to your own encrypted bucket

Oh, Proton Drive. When will they release a client for Linux? And when they will start adding AI to all Proton products?

I use a synology NAS on my home network with syncthing over a wireguard tunnel for dropbox-esque functionality from anywhere (only problem is poor iOS support). Nightly snapshotting to backblaze.

Logged into Dropbox to see (EU based). Setting wasn't there. Clicking through to the quoted tweet, they also report further on in their thread: I created the account when I was in the US, but now in the EU. (https://twitter.com/Werner/status/1734898806708166709)

In the "What's new" part within the Dropbox environment, I did find a note dated October 10, 2023:

Quickly find the content you need with Dropbox AI

Dropbox AI for search helps you get the information you need without the hassle of manually searching through Dropbox. Ask a question about your Dropbox content and get a response within seconds. You can also find the files you need with everyday language instead of searching by keywords, and search results now come with a brief summary of each file.

Then, once you’ve opened individual files, Dropbox AI for file previews now lets you save time and effort by summarizing your content, from long documents to lengthy videos, into a clear and concise explanation with the click of a button.

Dropbox AI is currently in alpha and available in the US in EN only for Dropbox Pro, Standard, Advanced, Essentials, Business, and Business Plus. Some features may be available soon for eligible non-US customers to test.

Logged into Dropbox to see (EU based). Setting wasn't there.

FWIW, just checked mine (EU-based "pro" account), and the setting is there but was OFF. i have never specifically engaged any features regarding AI in dropbox.

i do recall seeing a popup in the web interface sometime in the past month about having AI summarize file content and i closed the popup without tapping anything which remotely appeared to be a consent button.

Others in the EU are reporting it's off by default for them as well. So it's probably configured deliberately as opt-out in the US and opt-in in Europe.

I would call that a win for European privacy regulation.

And doubly scummy behavior on the part of Dropbox.

this sounds so stupid. how can some AI help me find what I need when I know what I need and use a manual search? That's like the definition of search

hey dropbox, get me that pdf about dinosaurs that I last accessed about 6 months ago

Entering "dinosaurs" in the search box and sorting by date is much faster, simpler, and more reliable than typing in all those words to an AI. That problem has already been solved decades ago.

Just turned it off in my account, appreciate the heads up/post. I can't stand when companies turn this type of thing "on" by default. Apple pulled the same thing with advertising settings a few iOS versions back.

I didn’t hear about that one. How can I check the new settings in my Apple account?

It was back in 2018 or 2019, I believe. I THINK it was maybe iOS 15? Here is an old Verge article I found that you can check your settings: https://www.theverge.com/22309965/block-ad-iphone-data-how-t... - It was turning off "Personalized Ads" in your settings. I believe today in iOS 17 it lives in `Settings > Privacy > Apple Advertising`

I can't stand when companies turn this type of thing "on" by default.

If you force people to do something they are more likely to do it then if you don't force them. Especially if they don't consent to doing it.

Dropbox has form. The reason I shut my account is they used the root permission you give when you install the package to give back accessibility access permissions to their app after I had turned them off. They then claimed (in a very mealy mouthed reply) that this had been done because people turned these permissions off by accident and so they were trying to be helpful. Here's that thread for people who want the context https://news.ycombinator.com/item?id=12464730

why do you trust that the setting does anything?

Right? I "understand" it but I don't understand it. It just ends up being gross and shady feeling and giving me a negative impression of the company that did it. I use dropbox, pay for the upgraded storage, and have for years. I love it. But they added some AI and decided I automatically wanted it. Makes me question whether I want to continue to be loyal to them.

Direct link to the setting: https://www.dropbox.com/account/ai

just routes to /account/general for me, no ai, and no ai options. strange.

Same for me. Are you a free user too? Might be that only Premium users get built in AI.

it's not built in AI, it's outsourced AI. this is basically Dropbox authorization of a third party to scan your files.

Same for me? I'm in Europe, maybe that makes a difference perhaps?

So to anyone wondering, I’m getting the sense is that the option is only available for paid / business accounts. My hunch is that the reason free accounts don’t see it is that they don’t get to opt out & are forced in - it wouldn’t make sense that they opt-in paid/ENT but then exclude free accounts altogether vs free accounts are opt-in and can’t choose. Alternatively, may be it isn’t relevant to free accounts because they don’t have access to AI-related features: https://help.dropbox.com/view-edit/privacy-settings-dropbox-...

The data isn’t used for training, only for inference & DropBox and OpenAI pinky promise to delete any data sent to them within 30 days.

I'd actually guess that free accounts don't have the "toggle AI" option because they just disable AI inference for free users. LLM inference is pretty expensive.

definitely. for a group of hackers, it's difficult to understand not seeing the play: Dropbox engaged OpenAI to process files a user requests to "understand" or search. then the files are sent. the switch would stop this.

imagine the wasted compute if the AI just went and scanned everything.

this is a adhoc service one-off. definitely turn it off if you don't want your files scanned by OpenAI.

but the cost of moving everyones file to an AI would be absurd.

I have a free account and this option was turned on by default (with the option to disable it).

Talk about scummy....

Correct me if I'm wrong but this seems like a poorly messaged setting and an overreaction by users on X. Sounds like they will use a commercial AI when you use Dropbox AI to ask about a document.

In that case your organization account should make the decision on enablinng this capability, Dropbox should not have carte blanche to scan your content ahead of time.

the cost of indexing with an AI would be absurd. it's more likely a one off Clippy type service where it's only sending it to openAI when the user requests.

still should be optin universally, but it's unlikely they're wasting compute scanning before a user even wants the service.

Yes, specifically they use the OpenAI API to implement their alpha AI features.

https://help.dropbox.com/view-edit/privacy-settings-dropbox-...

bad UI and company design...one should NEVER EVER cause any user of any service to take extra actions to respect their rights and data. It should be the reverse...if you want to use AI or have AI use your data then you need to take extra steps...

This is dark patterns all over again

Dropbox crossed the bad UI rubicon for me when it limited upload speed on my free account to sub-dial up rates. This was in 2012.

I just put everything in Google Drive and a USB stick and have never looked at DB again.

Limited your upload speed on a free account? I'd hardly call that a dark pattern.

The transfer speed is slower than using Bluetooth. Free users would have dumped the tool immediately. What DB did was throttle the speed only after I had uploaded a set of files, and then bug me to upgrade to paid.

This tweet is sort of misleading, the docs suggest this is basically them using an API to provide AI features: https://help.dropbox.com/view-edit/privacy-settings-dropbox-...

Your files within Dropbox are sent to a third-party AI only when you chose to interact with AI powered features. For example, when you ask a question about a file.

chose to interact with AI powered features

puts the burden on the user to understand what an "AI powered feature" is

yeah, some of these posts take a weird tact on privacy. the switch prevents access to files via openai's API, but for that to be relevant you need to engage the Dropbox AI.

really, the trouble is Dropbox is outsourcing your private files to a third party and masking that via a optin (in the US) toggle.

I don't think users should have to worry that their service negotiated a invasive privacy process with a third party and they aren't being forthright about how it leaves the premise.

I noped out of Dropbox when they started requiring the installation of a kext for the macOS client to function - it signaled a lack of respect for the boundary between my system/data and theirs. This news has me feeling vindicated in that decision.

What could it possibly need a kext for? I use SyncThing to sync my files and it doesn't even need to be root!

The stated reason was to implement a feature called "Dropbox Infinite" that downloaded files on demand when first accessed, rather than syncing everything ahead of time.

People should be encrypting their files before uploading them to the cloud. Then it won't matter who your data is shared with.

How would you recommend doing that in a transparent way on MacOS/Windows/Linux?

Something like Cryptomator (https://cryptomator.org/)

Paying customer here: Mine was disabled, for the record.

For balance, paying customer here, and mine was enabled.

I'm a paying customer and mine was enabled as well, and this is the first I'm even hearing about it. That's not a good feeling.

(How) Can I turn that off for the entire company account?

Changing the setting redirects me to "https://www.dropbox.com/team/admin/settings/ai" in the Admin Console so I assume this controls it for the entire team.

It was switched-off for me (based in Europe).

Edit: based on their help page "In countries with the preferred language set to English. Excluding Canada, the UK (United Kingdom), and countries within the EEA (European Economic Area)." https://help.dropbox.com/view-edit/privacy-settings-dropbox-...

Thanks for posting that link, that sheds a lot of light on this topic.

I’m also in the EU, and the button was switched off for me too.

I think this should be switched off, and against the law, but the tweet is hyperbolic. It specifically states that the data is not for training.

So? What is preventing the company from just using it anyway and paying a fine later? The culture of these growthmaxxing companies pretty much ensures a philosophy of "don't ask for permission, ask for forgiveness".

It's weird that Dropbox would want to pay Open AI to do whatever it is they are doing on everyone’s files, without knowing if a use will ever use or see that feature. It sounds like a premium feature that you would want a user to have to manually enable.

I have no doubt that this "feature" is a backroom deal worth millions because OpenAI is running out of public internet data with which to improve its models. (See this paper from researchers at MIT and a few other schools which predicts that high-quality text training data will be 'used up' by 2026: https://arxiv.org/abs/2211.04325 )

Think of all of the email, Google Docs, and other data that Alphabet has that it can use to train and improve its models. OpenAI has limited ways to get non-public text data unless Microsoft is giving them some data from Office users, Hotmail users.

Just my two cents. And whatever Dropbox is doing with retrieval augmented generation (RAG) / "new+better search" with the OpenAI APIs: I'm certain it could be done with less latency and probably would cost less if the RAG 'feature' / 'new search' was built in house at Dropbox.

This is the description on Dropbox's website

Use artificial intelligence (AI) from third-party partners so you can work faster in Dropbox. We only use technology partners we have vetted. Your data is never used to train their internal models, and is deleted from third-party servers within 30 days.

What the fuck?! How is this not opt-in?!

If you care about your data being private and not shared, why would you use a non-end-to-end-encrypted service like Dropbox in the first place, where the provider can see all of your data and share it as they please?

Make the choice once, up front, and then you can’t be surprised by things like this.

See also: Dropbox spooks users with new AI features that send data to OpenAI when used

https://arstechnica.com/information-technology/2023/12/dropb...

It was ON by default in my personal, paid Dropbox Plus account (in Canada).

https://i.imgur.com/qUKdMcB.png

I'm incensed about this. I guarantee I never activated this setting or anything remotely like it, or ever used any features that would justify it. This really crosses a line for me.

Wat? Shouldn't it be the opposite way, that you turn this on? those SV companies are getting hubris

Never liked Dropbox from the get-go for some reason, and things like this keep proving my intuition right

the best way to do this is with:

https://cryptomator.org

Is there any recourse for users?

I’m kind of surprised why paid users wouldn’t be default opted out?

Am I missing something about being customer centric to force them to work for free for your software to manage it in addition to paying for it?

I understand how this might be in Dropboxes to let third parties create “synthetic data” of users proprietary data. Using it “at my request” for my benefit is the first step.

Maybe Dropbox could just opt put off their partners to not keep their customers information.

I didn’t think this would be the thing that got me to cancel and move Dropbox to something slower like Sync.com, but here we go.

Is there something similar to this for Google Drive?

META: Why is this not on the front page? It has more points than almost every other story and less time than most.

Goodbye Dropbox. You don't by default turn on customer-exploitative features.

That's abusive.

Mega encrypts everything by design. Why use corporate crap and keep up with their lying to you when you can use products that don't steal your data. I'm surprised Dropbox is still in business. At some point their fancy product name won't save them from the consequences of their lying to the customers.

The best way to opt out of Dropbox's abusive practices is to pull all your data out into a self-hosted or trustworthy e2e solution and close your account. You should need no more proof than this incident that Dropbox will not ask you before doing things with your data that you would have strenuously objected to if they had.

Why dont OpenAI just deploy The Box (TM)?

Reminded me to finally delete my account of... 15 years!!! Good riddance.

It's enough of other companies making money on our data. That's why I started Skiff (end-to-end encrypted email/docs/drive/calendar)! It's harder to build products E2EE but you get long-term trust from users.

I didn't see the setting in my Dropbox account. Maybe because I have "Early access" disabled? Either way, not a fan of an opt-in setting that shares your data when it's supposed to just be a place to store files.

Get access to products and features that Dropbox is still testing and evaluating, and give feedback to help our product teams build the best final product.

This is why rsync or it's user-friendly counterpart syncthing better. Seems like that old comment did have a point after all.

Glad I never gave in and used this nonesense.

I just checked my company's account. Third Party AI-Integrations were defaulted to "On" despite our company having a paid personal account.

My free personal account (still for work) does not have any active third party integration.

I stopped using Dropbox years ago after they had the gall to delete some of my files and email a warning that pirated files weren't permitted. Except that they weren't pirated files - they were MP3s ripped from my own CDs for my own personal use. That's when I realized that they actually scan your files and there was no privacy, completely unacceptable. For some years I've used Sync.com, which is vastly better, but sadly their software and systems are completely broken once you get beyond a certain total size of file data (probably around 1TB, but they're happy to take your money for much more space, which can't be used because of their system bugs.)

The tweet seems to contradict the screenshot.

The fact that this is necessary or opt out for that matter blows my mind

Seems optional opt out is EU only…

Your data is never used to train their internal models, and is deleted from third-party servers within 30 days.

Sure, because they paid you money for access and are very trustworthy people.

[dupe] / Related:

Dropbox is sharing your files with AI partners without opt-in

https://news.ycombinator.com/item?id=38627751