Ireland’s Data Protection Commission (DPC) has opened a formal investigation into X’s AI chatbot Grok, focusing on how personal data is processed and the tool’s potential to produce harmful sexualised images and video, including of children.
The Ireland Grok probe centers on concerns about the creation and publication of potentially harmful, non-consensual intimate and/or sexualised images on the X platform, where such content may involve the personal data of European users, including children.
What Ireland’s DPC is investigating
The DPC said it notified X on Monday that it was beginning the inquiry, and said the purpose is to determine whether X has met its obligations under the EU’s General Data Protection Regulation (GDPR) in relation to the personal data being processed.
In its description of the inquiry, the DPC referenced the alleged ability of X users to prompt the @Grok account on X to generate sexualised images of real people, including children.
Ireland’s regulator is the lead EU watchdog for X because the company’s European Union operations are based in Ireland.
The DPC can impose fines of up to 4% of a company’s global revenue under the GDPR.
Why Grok drew scrutiny
According to a Reuters account carried by multiple outlets, Grok “flooded” X last month with AI-altered, near-nude images of real people in response to user requests, prompting widespread global outrage and investigations.
X announced curbs intended to stop Grok’s account on the platform from producing these kinds of images, but Reuters reported that the chatbot continued to generate them when prompted.
A Reuters video report also describes tests in which Reuters submitted photographs of other reporters who agreed to participate while presenting them as strangers, and then asked Grok to remove clothing and generate sexualised images even after telling the chatbot the output would be used to harass or humiliate the subjects.
In the same Reuters video report, the correspondent says other chatbots asked to do the same thing refused.
A Malwarebytes write-up summarizing Reuters’ testing said nine Reuters reporters ran dozens of controlled prompts through Grok after X announced new limits on sexualised content and image editing, and that Grok produced sexualised imagery in response to many prompts in both an initial round and a second round five days later.
That Malwarebytes summary also said competing systems from OpenAI, Google, and Meta refused identical prompts and warned users against generating non-consensual content.
What the inquiry covers under Irish and EU law
The Law Society of Ireland’s Gazette reported that the probe into X Internet Unlimited Company (XIUC) is taking place under section 110 of Ireland’s Data Protection Act 2018.
The Gazette said the DPC’s inquiry concerns “the apparent creation, and publication on the X platform, of potentially harmful, non-consensual intimate and/or sexualised images,” and that such images contain or otherwise involve the processing of personal data of European users, including children.
Deputy Commissioner Graham Doyle said the DPC had been engaging with the company since media reports first emerged about the alleged ability to prompt @Grok to generate sexualised images of real people, including children, and described the inquiry as “large-scale.”
Euronews reported that the DPC’s investigation relates to the processing of personal data and Grok’s potential to produce harmful sexualised images and video, including of children, and that the inquiry will examine XIUC’s compliance with “fundamental obligations” under GDPR.
Other regulatory actions mentioned
The Reuters report carried by WHBL said the European Commission opened an investigation on January 26 into whether Grok disseminates illegal content such as manipulated sexualised images in the EU.
That same Reuters report said Britain’s privacy watchdog launched a formal investigation on February 3 into Grok over the processing of personal data and its potential to produce harmful sexualised images and video content.
Separately, the Law Society of Ireland’s Gazette reported that last month the European Commission launched a new investigation under the Digital Services Act (DSA) into how X deployed its AI tool Grok in the EU.
Euronews also reported that the European Commission launched formal investigations into Grok in January, and said other countries, including the United Kingdom and France, have threatened legal action or opened investigations into Grok.
Euronews added that Grok came under fire last year after it built a feature called “Spicy Mode,” which it said allowed users to prompt the chatbot into “undressing” images of women and generating AI-created deepfakes without consent or safeguards.
