Ireland’s Data Protection Commission has opened a formal investigation into X’s Grok AI chatbot over its ability to generate nonconsensual deepfake images, including sexually explicit content involving minors. The investigation marks a significant escalation in regulatory scrutiny of Elon Musk’s AI system across Europe.
The Investigation
The Data Protection Commission announced it informed X on Monday about the initiation of the investigation in accordance with data privacy laws applicable across the 27 EU member states. As the lead supervisory authority for X Internet Unlimited Company across the EU and European Economic Area, Ireland’s regulator is conducting what it describes as a “large-scale inquiry” focused on the company’s compliance with fundamental obligations under the General Data Protection Regulation (GDPR).
The Core Issue
The controversy centers on Grok’s “Spicy Mode” feature, which allowed users to prompt the chatbot into generating manipulated images of women appearing undressed or in bikinis. Media analyses found that Grok often complied when users prompted it to generate sexually suggestive images of minors, including one of a 14-year-old actress.
X’s Response and Ongoing Issues
X responded by announcing curbs to stop Grok from producing such images; however, reports indicate the images are still being produced. This failure to implement effective safeguards has intensified regulatory pressure on the platform.
Potential Penalties
Ireland’s Data Protection Commission can levy fines of up to 4 percent of a company’s global revenue under EU rules. The financial stakes are substantial for X, which operates its European headquarters in Dublin.
Broader International Scrutiny
The European Commission launched formal investigations into Grok in January, while other countries, including the United Kingdom and France, have threatened legal action or opened investigations into Grok. In early February, French prosecutors raided X’s Paris office and summoned Musk for questioning.
The investigation represents a critical test of how regulators will hold AI developers accountable for safeguarding systems that generate nonconsensual intimate imagery, particularly when those systems target minors.