Ireland’s Data Watchdog Joins Global Regulators Probing X Over AI Image Risks

Ireland’s privacy regulator has opened a formal investigation into X over whether Elon Musk’s Grok chatbot helped generate and spread non-consensual sexualised images, including of children, adding heat to a widening global crackdown on AI “nudification” tools.

The Data Protection Commission (DPC) launched the inquiry into X Internet Unlimited Company (XIUC),  the EU-registered legal entity through which Elon Musk’s social media platform operates in Europe, under Ireland’s Data Protection Act 2018, focusing on “the apparent creation, and publication on the X platform, of potentially harmful, non-consensual intimate and/or sexualised images… including children” using Grok’s generative AI tools.

The watchdog said it notified XIUC of the decision to commence the inquiry and will assess compliance with core GDPR requirements, the EU’s General Data Protection Regulation, including principles of processing, lawful basis, privacy-by-design, and whether a data protection impact assessment was required.

“As the Lead Supervisory Authority for XIUC across the EU/EEA, the DPC has commenced a large-scale inquiry which will examine XIUC’s compliance with some of their fundamental obligations under the GDPR in relation to the matters at hand,” Deputy Commissioner Graham Doyle said in the statement.

The investigation comes as Ireland, which serves as the EU’s lead supervisory authority for most major American tech platforms, giving its rulings binding weight across the bloc, joins a widening international response to Grok’s role in generating non-consensual deepfakes at scale.

The Center for Countering Digital Hate (CCDH) reported last month that Grok generated an estimated 23,338 sexualized images depicting children, over an 11-day period from December 29 to January 9, and researchers found about one-third of those sampled images remained accessible on X despite the platform’s zero-tolerance policies.

Following the backlash, X restricted Grok’s image generation and editing to paid subscribers, added technical barriers to stop users from digitally manipulating people into revealing clothing, and geoblocked the feature in jurisdictions where such content is illegal.

Decrypt has reached out to xAI for comment.

Global regulatory crackdown

In January, the European Commission opened a formal Digital Services Act probe into X over Grok’s alleged role in generating and spreading illegal sexualized content. Days later, French authorities raided X’s Paris offices in coordination with Europol, summoning Musk and several executives for questioning.

In the UK, both Ofcom and the Information Commissioner’s Office opened separate investigations, with Ofcom warning it could seek court-backed measures to effectively block X’s service if found non-compliant, as Prime Minister Keir Starmer said he would seek new parliamentary powers to bring AI chatbot providers under online safety law.

Australia’s eSafety Commissioner Julie Inman Grant said complaints involving Grok and non-consensual AI-generated sexual images have doubled in recent months, and said her office would use its enforcement powers where needed.

California Attorney General Rob Bonta announced a formal investigation into xAI and Grok over the creation and spread of non-consensual sexually explicit AI images of women and children.

Earlier this month, UNICEF called AI sexual deepfakes “a profound escalation of the risks children face in the digital environment,” saying at least 1.2 million children were targeted last year and urging governments to criminalize AI-generated abuse material and require safety-by-design safeguards.