The Irish Data Protection Commission (DPC) has launched an investigation into the artificial intelligence model known as Grok, developed by xAI, a company owned by U.S. entrepreneur Elon Musk.
Focus on GDPR Compliance
The inquiry is being conducted under the European Union’s General Data Protection Regulation (GDPR) and will examine whether the personal data of users on the X platform—also owned by Musk—was lawfully processed in the development and operation of Grok.
Grok, made available to all users of the X social media platform since December 2024, can generate biographical summaries of individuals with accounts on the platform. Questions have been raised regarding the legality of using EU users’ personal data for such functionality and whether xAI complied with GDPR’s transparency obligations.
Background and Previous Commitments
This is not the first time the DPC has scrutinized the use of personal data by X. In mid-2024, the regulator opened and quickly closed a preliminary investigation into the company following concerns over the potential use of users’ data to train Grok. At that time, X committed to permanently halt the processing of EU users’ data for AI training purposes and to delete any data previously used in such a manner.
However, in August 2024, consumer advocacy groups including Euroconsumers, Italy’s Altroconsumo, and the European Center for Digital Rights (Noyb) submitted formal complaints to the DPC, alleging multiple violations of GDPR by X.
Potential Consequences
The company now under investigation, X Internet Unlimited Company—formerly Twitter International Unlimited Company as of April 1, 2024—is based in Dublin and serves as the data controller for EU users. Under GDPR provisions, it could face fines of up to 4% of its annual global revenue if found in violation of the regulation.
The investigation remains ongoing, and the DPC has not yet released a timeline for its conclusions.
