Ireland’s Data Protection Commission (DPC) opened an inquiry into social media platform X on Tuesday following reports that its AI chatbot has produced sexual deepfake images.
The DPC investigation concerns the apparent creation and dissemination “of potentially harmful, non-consensual intimate and/or sexualised images” on X created using integrated AI chatbot “Grok,” developed by owner Elon Musk’s xAI. Many “deepfake” images have reportedly contained or involved personal data of European users, including children.
Deputy Commissioner Graham Doyle said the regulatory body has engaged with X for weeks following media reports that users could “prompt the @Grok account on X to generate sexualised images of real people, including children.” He said the “large-scale inquiry” will examine X’s “compliance with some of their fundamental [legal] obligations.”
The probe will determine whether X has complied with General Data Protection Regulation (GDPR) obligations under Article 5 (principles of processing), Article 6 (lawfulness of processing), Article 25 (data protection by design and by default), and Article 35 (requirement to carry out a Data Protection Impact Assessment).
European regulatory agencies have continued to place pressure on X and its AI chatbot. Last month, the European Commission launched a new investigation, under the Digital Services Act, into how X has deployed Grok in the European Union. Various jurisdictions, such as California, Canada, Spain, France, and the UK, have also launched investigations into Grok. This investigation marks the latest development in the crackdown against X’s use of people’s personal data.
X previously introduced restrictions on Grok following criticism that it could be used to “undress” people or depict them in revealing or sexualized ways. However, European authorities appear unconvinced that these measures sufficiently prevent harm.
Ireland’s DPC is the lead EU regulator for X because the company’s European headquarters are based in Dublin. It has the authority to impose fines of up to four percent of a company’s total global annual revenue.
The regulatory body notified X of the investigation on Monday. The DPC is allowed to “cause such inquiry as it thinks fit…to ascertain whether an infringement has occurred or is occurring” of data protection law per section 110 of the Data Protection Act 2018. Musk or X have not yet publicly responded to DPC’s announcement.