Elon Musk’s social media platform X, formerly known as Twitter, is under formal investigation by Ireland’s Data Protection Commission (DPC) for its use of European users’ public posts in training its artificial intelligence chatbot, Grok.
The DPC is assessing whether X’s data practices comply with the European Union’s General Data Protection Regulation (GDPR), particularly focusing on the legality and transparency of using personal data for AI development. Given that X’s European headquarters are in Dublin, the Irish regulator serves as the lead supervisory authority for the platform across the EU.
In a statement to the Irish Independent, the DPC said: “The inquiry will examine compliance with a range of key provisions of the GDPR, including with regard to the lawfulness and transparency of the processing.”
Under GDPR, in force since 2018, companies must process personal data in a lawful, fair, and transparent manner, with strict limitations on how such data can be collected, used, and stored. Violations can result in fines of up to 4% of a company’s global revenue.
The investigation zeroes in on data controlled by X Internet Unlimited Company—specifically public posts made by users within the EU and European Economic Area.
As the DPC further explained: “Like other modern LLMs, the Grok LLMs have been developed and trained on a wide variety of data. This inquiry considers a range of issues concerning the use of a subset of this data which was controlled by X Internet Unlimited Company—namely personal data comprised in publicly accessible posts posted on the ‘X’ social media platform by EU/EEA users.”
“The purpose of this inquiry is to determine whether this personal data was lawfully processed in order to train the Grok LLMs,” the DPC added. “The decision to conduct the inquiry under Section 110 of the Data Protection Act 2018, taken by the Commissioners for Data Protection, Dr Des Hogan and Dale Sunderland, was notified to XIUC this week.”
This inquiry follows previous legal tensions, during which X agreed to halt the use of EU users’ data for AI training without their consent, resulting in the dismissal of earlier court cases.