Ireland Seeks Review of Grok for Potential GDPR Violations
Regulatory Scrutiny on X’s Use of User Data for AI Training
Elon Musk’s social media platform, known as X, is currently facing regulatory scrutiny in Europe. The focus of concern is on the platform’s use of publicly available posts from EU users to train its AI chatbot, Grok. This investigation raises significant questions about compliance with the General Data Protection Regulation (GDPR).
Investigation by Irish Data Protection Commission
The Irish Data Protection Commission (DPC) announced on a recent Friday that it has initiated a probe into X Internet Unlimited Company (XIUC). This newly named Irish entity is responsible for Musk’s platform. The inquiry aims to determine if XIUC’s methods of processing public posts from EU users for AI training are consistent with GDPR requirements.
XIUC is recognized as the official data controller for EU users as of April 1, following a transition from its previous identity as Twitter International Unlimited Company (TIUC).
AI and User-Generated Content
Like several other social media platforms venturing into artificial intelligence, X utilizes content created by its users to enhance its AI systems. Specifically, X leverages publicly available data—such as user posts, profiles, and interactions—to train its chatbot, Grok. This has raised privacy concerns, particularly because users were not clearly informed about whether their data was being used for such purposes. Initially, user accounts were set to share data by default, which has drawn criticism over adherence to data protection laws.
Partnership with xAI and its Implications
A significant development occurred in March when xAI acquired X in an all-stock deal valued at $33 billion. This merger means that both the AI platform and the social media service are now under Musk’s control, combining user data and artificial intelligence capabilities under a single umbrella.
The DPC has stated that this inquiry will explore the legality of X’s handling of public posts that contain personal data of EU users for training Grok’s large language models (LLMs).
Growing Concerns Over AI Regulations
X is not the only entity facing scrutiny regarding its data practices. Other companies that develop LLMs, such as OpenAI, have encountered similar investigations. For instance, OpenAI has faced GDPR complaints concerning inaccuracies in the information provided by ChatGPT and the lack of mechanisms for users to correct errors in their data. Efforts are being made in the EU to establish clearer regulations, with the implementation of the Artificial Intelligence Act, which aims to regulate AI technologies comprehensively.
X has been subjected to additional regulatory inquiries, as it became one of the first companies to face formal actions under the EU’s Digital Services Act (DSA). A separate investigation initiated by the European Commission is examining X’s adherence to risk management, content moderation, and algorithm transparency—critical components for platforms designated as Very Large Online Platforms (VLOPs).
Context of Trade and Regulatory Relations
The investigation of X occurs amid increasing tensions in transatlantic trade relations. Fluctuating tariff policies from the Trump administration have contributed to uncertainties in global commerce, and the EU has considered potential countermeasures targeting U.S. companies in case trade negotiations fail. Although the DPC’s investigation coincides with these developments, officials have clarified that there is no direct link between the two issues.
The DPC has indicated that this investigation began last summer, well before the escalation of trade tensions. As of now, X has not publicly commented on the ongoing inquiry.
This situation underscores the complex interplay between technology, user privacy, and regulatory oversight, particularly as social media giants increasingly leverage user data to develop advanced AI systems.
