The Irish Data Protection Commission (DPC) has launched an investigation into X, the social media platform owned by Elon Musk, concerning its use of user data to train its AI chatbot, Grok. The inquiry, initiated in April 2025, centers around the processing of personal data from publicly accessible posts made by EU users of X. The DPC aims to determine whether this data was lawfully processed in compliance with the General Data Protection Regulation (GDPR).

The probe will scrutinize X Internet Unlimited Company (XIUC), the Irish entity responsible for the platform, and its adherence to GDPR, including the lawfulness and transparency of data processing. XIUC became the official data controller for EU users on April 1, 2025, following a rebranding from Twitter International Unlimited Company (TIUC).

Like many social media platforms exploring AI, X utilizes user-generated content to train machine learning models. X shares publicly accessible data, including posts, profiles, and user interactions, with xAI to develop and refine Grok. This practice has raised privacy concerns, as users were initially opted in by default, leading to scrutiny over compliance with data protection regulations.

This isn't the first time X has faced scrutiny over its data practices. In 2023, X agreed to suspend the use of EU citizens' data to train its AI models after facing pressure from the Irish regulator. The current investigation seeks to determine whether X has been complying with GDPR, particularly regarding lawful data processing and transparency.

Under GDPR, personal data, even if publicly available, cannot be repurposed for unrelated uses like AI model training without a clear legal basis and sufficient transparency. Companies must prioritize clear communication about data collection and usage, and opt-in models for data sharing should be the standard.

The DPC has the power to impose penalties of up to 20 million euros or 4% of a company's total annual revenue for severe GDPR violations. In August 2024, the DPC launched proceedings in Ireland's High Court against TIUC, relating to the use of X users' personal data to train Grok. X agreed to suspend the processing of personal data collected between May and August 2024, and the proceedings were terminated in September 2024 after X agreed to permanently discontinue the processing of some personal data.

X has faced criticism for its role in spreading misinformation, lack of transparency regarding manipulated content, and disregard for data protection and transparency. These issues have raised questions about its commitment to ethical practices.