Grok faces more scrutiny over deepfakes as Irish regulator opens EU privacy investigation

Elon Musk’s social media platform X faces an EU privacy investigation after its artificial intelligence chatbot Grok generated nonconsensual deepfake images, Ireland’s Data Protection Commission announced Tuesday.

The Irish regulator formally notified X on Monday that it was opening an inquiry under the European Union’s General Data Protection Regulation (GDPR). This investigation adds to mounting regulatory pressure on X in Europe and elsewhere over Grok’s controversial image generation capabilities.

The probe was triggered by widespread reports last month that Grok was fulfilling user requests to create sexually explicit or revealing images of real people without their consent. Researchers discovered the AI tool was generating images of women in transparent clothing or revealing attire, with some of the generated images allegedly including children.

“We have been engaging with X since media reports started circulating weeks earlier about the alleged ability of X users to prompt the @Grok account to generate sexualized images of real people, including children,” said Deputy Commissioner Graham Doyle in a statement.

The investigation will specifically examine whether X violated EU privacy regulations through the “apparent creation and posting on X of potentially harmful nonconsensual intimate or sexualized images” containing Europeans’ personal data.

X did not respond to requests for comment on the investigation.

Grok, developed by Musk’s AI company xAI, is integrated into the X platform where its responses to user prompts are publicly viewable. After the initial backlash, X introduced some restrictions on the AI tool’s image generation capabilities, but European regulators have deemed these measures insufficient.

The Irish Data Protection Commission serves as the lead regulator for enforcing GDPR compliance for X since the company’s European headquarters is based in Dublin. If found in violation, X could face significant financial penalties under the EU’s privacy framework, which allows fines of up to 4% of a company’s global annual revenue.

This investigation represents just one facet of X’s growing regulatory challenges in Europe. Earlier this month, French prosecutors raided the company’s Paris offices and summoned Musk for questioning regarding the same issue. British authorities, including the UK’s data privacy watchdog and media regulators, have launched their own separate investigations into X despite Britain’s departure from the EU.

The platform also faces another EU investigation from Brussels officials examining whether X has been complying with the Digital Services Act, the bloc’s comprehensive rulebook for protecting social media users. That investigation focuses on whether the platform has adequately curbed the spread of illegal content, including child sexual abuse material.

The controversy surrounding Grok highlights the broader challenges facing AI companies as they develop increasingly sophisticated image generation tools. Regulators worldwide are grappling with how to address the potential for these technologies to create nonconsensual intimate images, deepfakes, and other harmful content.

This investigation also underscores the EU’s increasingly assertive approach to regulating tech companies and artificial intelligence. With the implementation of both GDPR and the more recent Digital Services Act, European regulators have established themselves as global leaders in creating and enforcing digital safeguards.

As AI development accelerates, the outcome of this case could set important precedents for how generative AI tools are regulated, particularly regarding their potential to create harmful content using real individuals’ likenesses without permission.