Twitter said on Tuesday it may have shared user data with advertisers without permission.
The social media giant said it found issues "where your settings choices may not have worked as intended."
The company said "certain data" of mobile users such as country code may have been shared with advertising partners since May 2018 "even if you didn't give us permission to do so."
Twitter also said since September 2018 it may have shown ads "based on inferences" made about users' devices, without consent.
A statement on the company's website insisted the data in question "stayed within Twitter and did not contain passwords or email accounts."
The issues were "fixed on August 5" and Twitter says it is conducting an investigation into who may have been impacted.