X Violated Canadian Privacy Law with Grok Deepfakes, Watchdog Says

Canada's privacy watchdog found that X (formerly Twitter) violated the country's federal private-sector privacy law when it launched an AI image generation tool that was used to create sexualized images of people without their consent. The Privacy Commissioner of Canada released a report Thursday summarizing the findings of a months-long investigation of Elon Musk's xAI and the social platform.

The investigation, opened in January, focused on xAI's Grok model. Users prompted the tool to generate non-consensual sexualized images of women and sometimes children, including child sexual abuse material. The commissioner found the company had not obtained consent from individuals whose likenesses were used and that its response to the widespread deepfakes was insufficient.

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), organizations must obtain meaningful consent for the collection and use of personal information. The report said xAI launched Grok without proper safeguards or privacy considerations, allowing users to create and share non-consensual deepfakes. The tool's launch did not include content filters or age verification measures that could have prevented the abuse.