The Irish Data Protection Commission (DPC) has launched an investigation into X, the social media platform owned by Elon Musk, concerning its use of personal data to train its artificial intelligence (AI) model, Grok. The inquiry, initiated on Friday, April 11, 2025, will focus on the processing of personal data from EU users' publicly accessible posts on X for training generative AI models.
This investigation aims to determine whether X's data processing practices comply with the General Data Protection Regulation (GDPR), a stringent EU law that governs data privacy and security. The DPC will specifically examine the lawfulness and transparency of the data processing involved in training Grok's large language models (LLMs).
Grok, developed by Musk's AI startup xAI, is a group of AI models that power a generative AI chatbot available on the X platform. These models require vast amounts of data to train and develop, raising concerns about the ethical implications of AI-generated content and the potential misuse of personal data.
The DPC's investigation follows previous engagement with X regarding AI models and personal data. In August 2024, X agreed to suspend processing personal data for Grok's training between May and August after an "urgent" High Court application. The DPC welcomed this agreement, calling it the first time a European data authority had taken such action.
As the lead EU regulator for X, due to the location of its EU operations in Ireland, the DPC has the authority to impose significant penalties for GDPR violations, potentially reaching up to 4% of the company's global revenue.
The inquiry highlights the growing tensions between the EU and the U.S. over tech regulations. U.S. President Donald Trump and other members of his administration have criticized EU regulation of U.S. companies, describing fines imposed on U.S. tech companies by the EU as a form of taxation. Musk has also voiced opposition to EU regulations, particularly those imposed directly by Brussels on online content.
X's updated data policy, effective November 15, 2024, has already sparked controversy over the platform's expanded rights to use user-generated content for AI training. The policy grants X a "worldwide, non-exclusive, royalty-free license" to utilize user content for various purposes, including training AI and machine learning systems. This has raised concerns about privacy, intellectual property, and the future of human creativity.
Users have expressed concerns about the lack of clarity regarding the ability to opt out of data sharing for AI training. The updated terms do not clearly state whether this option remains available, leaving users uncertain about their ability to control how their data is used.
The DPC's investigation is not an isolated incident. In February 2025, the Canadian Privacy Commissioner also launched an investigation into X's use of personal data in AI training, examining whether the platform is complying with Canadian privacy law.
The Irish DPC's proactive approach to regulating AI is further evidenced by its request to the European Data Protection Board (EDPB) for an opinion on the use of personal data for AI model development and deployment. The EDPB's opinion provides guidance on key issues such as anonymization, legitimate interest as a legal basis for data processing, and the consequences of unlawful data processing in AI model development.
As AI becomes more integrated into society, transparent data practices and user protection will be essential in maintaining the trust and integrity of the platforms and technologies that shape our future.
