# Dropbox privacy rating

Cloud storage and file sync service with desktop, mobile and web apps. Files are encrypted at rest with keys Dropbox holds, not end-to-end.

## Summary

Dropbox scores 53 out of 100 (grade D) on the encrypted cloud storage criteria. It meets 4 of 8 criteria: no ads or data sales, transparency report, tells users about requests and TLS configuration. It partly meets independent audit and security headers. It does not meet open source and no trackers or telemetry. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://www.dropbox.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web, Windows, macOS, Linux, Android, iOS
- Home page trackers: none found
- Category: [Encrypted cloud storage](https://privacyratings.com/cloud-storage/)
- Also rated: [Dropbox Sign](https://privacyratings.com/e-signatures/dropbox-sign/) (Electronic signatures)
- Grade: D (53/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The Android app includes Adjust, Amplitude, Google Firebase Analytics and Sentry. | https://reports.exodus-privacy.eu.org/en/reports/com.dropbox.android/latest/ |
| No ads or data sales | Yes | Funded by paid plans, with no ads in the service. Dropbox states it does not sell user information to advertisers. | https://www.dropbox.com/privacy |
| Independent audit | Partial | Dropbox has third-party SOC 2 audits and ISO certifications. Only the SOC 3 summary report is public. | https://www.dropbox.com/business/trust/compliance/certifications-compliance |
| Transparency report | Yes | Publishes counts of government requests for user data and its responses twice a year. | https://help.dropbox.com/transparency |
| Tells users about requests | Yes | Dropbox's principles commit to notifying users of government requests unless a non-disclosure order prohibits it. | https://help.dropbox.com/transparency |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.dropbox.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.dropbox.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/cloud-storage/dropbox/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/cloud-storage/dropbox.md