Is it legal to use a third-party Twitter API?

#Is it legal to use a third-party Twitter API?

Three sets of rules decide whether a project built on a third-party Twitter API is lawful, and each asks a different question:

1. Computer-access law asks whether anyone entered a system they had no right to enter. Protected accounts, private messages and other people's logins are where that line runs.

2. Contracts ask what you agreed to: the terms of the provider whose key you use, and X's terms for anything you do on X itself.

3. Privacy law asks what you keep about people. A public post with a name or a handle on it is still personal data in the EU and the UK.

On the first layer, US courts have drawn the line around public data. In hiQ Labs v. LinkedIn (opens in a new tab), the Ninth Circuit held in April 2022 that collecting public LinkedIn profiles was likely not access "without authorization" under the Computer Fraud and Abuse Act. Later that year the same case went against hiQ on contract, when the trial court found it had broken LinkedIn's user agreement. Law and contract are separate questions, and both count.

Collecting data from x.com yourself is a different question with its own answer, covered in is it legal to scrape Twitter.

#Whose terms apply when you use a third-party API?

Each document people quote in this debate is a contract with the people who accept it, so start by sorting out which ones you have accepted. We read each of them on November 2, 2026:

• The provider's terms of service

  Who accepts it

  You, when you create an account and take an API key

  The lines that matter here

  What you may do with the data, and your duty to follow the laws that apply to you

• X Terms of Service (opens in a new tab), in force since October 9, 2026

  Who accepts it

  You, when you sign up for X or use its site, apps or official API

  The lines that matter here

  How you may use X and your X account; authors "retain ownership and rights" to their posts

• X Developer Agreement (opens in a new tab) and Developer Policy

  Who accepts it

  Developers who use the official X API

  The lines that matter here

  Cover the official X API and the content it returns: rate limits, caps on sharing data, no training of foundation models

Read the documents you have accepted in full. If you sign in to X or run an app on the official X API, X's rules cover that use too.

The 2023 rule about third-party apps

The rule quoted most often in answers about third-party APIs is narrower than it sounds. In January 2023, after cutting off third-party apps such as Tweetbot and Twitterrific, Twitter added a line to its Developer Agreement that bars developers from using the official X API "to create or attempt to create a substitute or similar service or product to the X Applications", as The Register reported (opens in a new tab) at the time. The line is still there today. It sits in the agreement that governs the official X API, and it targets apps that replace X's own apps.

#What privacy law asks when you keep public posts

Privacy law follows the people in your data, not the API you got it from, so the same rules apply to every source. The two laws most teams meet first treat public posts in opposite ways:

• GDPR (opens in a new tab) (EU, EEA) and UK GDPR

  Applies when

  You are established there, or you offer services to people there or monitor their behavior

  Are public posts personal data?

  Yes: any information about an identifiable person, a handle included

  What it asks of you

  A lawful basis such as legitimate interests, a notice to the people concerned unless that takes disproportionate effort, only the data you need, deletion when you no longer need it

• CCPA (opens in a new tab) (California)

  Applies when

  Your business meets its thresholds and holds data on California residents

  Are public posts personal data?

  No for what a person made available to the general public; yes for the profiles you infer from it

  What it asks of you

  Notices and answers to privacy requests for the personal information you hold, inferred profiles included

Two points catch teams out. The GDPR restricts data that reveals political opinions, religion, health or sexual orientation, so keep those inferences out of your project. And your copy should stay current: a post deleted on X, or an account that went private, shouldn't live on in your database.

#Who owns the posts you collect?

The people who write posts own them. X's Terms of Service say users keep ownership of what they post and give X a license to show it, and photos and videos belong to their authors in the same way.

That shapes what you can do with the data. Counting posts, measuring engagement, tracking a topic over time and quoting a post with a link back to it are the everyday uses of X data. Republishing full posts in bulk or selling a dataset of them is where the authors' copyright comes in, so share links or post IDs instead of the full text.

#What to check before you use a third-party Twitter API

Six checks cover the risks that land on you, the customer, and each takes a few minutes:

1. Keep your X account out of it. Never give a data tool your X password, cookies or session token: X can lock accounts that automated tools sign in to.

2. Stay with public data. Leave out protected accounts and private messages; a tool that returns them reads data its owners never made public.

3. Read the provider's terms before you pay. Look for what you may do with the data, how long the provider keeps your requests and which company stands behind it.

4. Keep only what the job needs. Store the fields you use, set a date to delete them, and drop posts that were deleted on X.

5. Know where the people in your data live. Monitoring people in the EU, the EEA or the UK brings the GDPR with it, wherever your company sits.

6. Check the track record. Years in production and the volume served show whether the data keeps coming after X's next change.

Price, speed and endpoints are the other half of the decision, and how to choose a Twitter API walks through those checks.

#How Sorsa API fits the checklist

Sorsa API, a Twitter (X) API and scraper, is built around the checks a customer controls: it returns public data only, it never touches your X account, and it costs a fraction of the official X API. For reading public X data with zero risk to your X account, use Sorsa API: tweets from $0.014 per 1,000 in batches of 100, against $5.00 per 1,000 posts on the official X API (opens in a new tab).

• Your X account

  Sorsa API

  Never asks for your X login, cookies or tokens: zero risk to your account

• Public data only

  Sorsa API

  Public posts, profiles, followers, lists and communities; never protected accounts or DMs

• Current data

  Sorsa API

  Every response is current, so deleted posts don't come back

• Terms before you pay

  Sorsa API

  Terms of Service and Privacy Policy on the site, and 100 free requests to test before any plan

• Your request data

  Sorsa API

  Full responses kept 30 days, request logs one year, then deleted

• Track record

  Sorsa API

  In production since 2022, 6B+ requests served, 99.9% uptime guaranteed in the terms

• Price

  Sorsa API

  Tweets from $0.014 per 1,000, 250x cheaper than the official X API

Sorsa API is read-only by design: it never posts, likes, follows or sends messages, so an integration can't act on X for anyone. It is run by Scouts Labs Inc (about Sorsa API), with uptime and security details in the open. X and the X logo are trademarks of X Corp; Sorsa API is not affiliated with, endorsed by, or sponsored by X Corp.

Your first request takes one key and no X developer account:

1. Create an account. Sign up and copy your API key from the dashboard; 100 free requests are already on it.

2. Look up a public profile. Send the username in the query and the key in the ApiKey header.

   curl -G "https://api.sorsa.io/v3/info" \
     -H "ApiKey: YOUR_API_KEY" \
     --data-urlencode "username=public_data_example"
   

3. Read the JSON. GET /info (opens in a new tab) returns the public profile: display name, bio, follower and following counts, and the date the account was created.

4. Batch the next job. POST /tweet-info-bulk (opens in a new tab) returns up to 100 public posts per request, each with its author's profile.

A request without a key returns 403, a wrong key 401, and more than 20 requests a second returns 429; failed requests are never charged.

#Start with public data and terms you've read

Using a third-party Twitter API to read public data is legal. Sorsa API takes care of the parts it controls: it returns public data only, with current responses, never asks for your X login and reads tweets from $0.014 per 1,000 instead of $5.00 on the official X API. Start with the 100 free requests, keep what your project needs, and build on it.

#FAQ