Canada's Privacy Commissioner finds X's Grok violated privacy law
Canada's Privacy Commissioner found that X's Grok AI chatbot violated privacy law by failing to implement adequate safeguards on its image generation feature, which allowed users to create millions of non-consensual sexualized deepfakes of women and children. The commissioner noted that Grok was generating over 6,000 such images per hour at peak usage.
What happened
In January 2026, X's Grok chatbot allowed users globally to create non-consensual sexualized deepfakes of women and children without sufficient safeguards on its image generation feature.
Privacy Commissioner Philippe Dufresne found that Grok was generating over 6,000 sexualized images per hour, resulting in millions of such deepfakes being created in total.
X later restricted the feature to paying X Premium members and introduced safeguards to reduce misuse, including proactive content removal and plans for quarterly reports and third-party audits.
Reported impact
The lack of protections allowed users to create and share non-consensual sexualized deepfakes, many targeting women and children.
Index analysis
The Privacy Commissioner recommended additional action to further improve safeguards and demonstrate their effectiveness, and noted the need for modern privacy laws with administrative monetary penalties.
Governance controls
X introduced new safeguards to reduce the risk of misuse for producing sexualized deepfakes and proactive sweeps to detect and remove harmful content on its platforms.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.