Ireland’s Data Protection Commission Launches GDPR Investigation Into X’s AI Chatbot Grok

Ireland’s Data Protection Commission (DPC) has opened a formal investigation into X’s AI chatbot, Grok, over concerns about personal data processing and the generation of harmful sexualised images, including manipulated content involving children. The probe marks a significant escalation in regulatory scrutiny of artificial intelligence platforms operating within the European Union under the General Data Protection Regulation (GDPR).

As X’s European headquarters are based in Ireland, the Irish DPC serves as the lead supervisory authority for the company across the EU and European Economic Area (EEA). Under GDPR rules, the regulator has the power to impose fines of up to 4% of a company’s global annual revenue for serious violations. The DPC confirmed that it notified X, formally known as X Internet Unlimited Company (XIUC), of the inquiry earlier this week.

The investigation will assess whether X has complied with its GDPR obligations regarding the processing of personal data linked to Grok’s operations. The move follows widespread controversy after Grok generated AI-altered, near-nude images of real individuals in response to user prompts. The incident sparked global backlash and prompted multiple regulatory reviews.

Although X announced measures aimed at restricting Grok from producing explicit or sexualised images, reports indicate that the chatbot continued to generate such content when prompted. The DPC stated it has been engaging with XIUC since media reports first surfaced about Grok’s ability to create manipulated sexualised images, including those involving minors.

The European Commission also launched its own investigation on January 26 to determine whether Grok has disseminated illegal content within the EU. Meanwhile, Britain’s data protection authority opened a separate inquiry on February 3 focusing on privacy risks and harmful AI-generated content.

The investigation highlights growing regulatory pressure on AI platforms and increasing tensions between EU regulators and major U.S. tech companies over data protection, online safety, and digital compliance standards.