Cybersecurity Policy Report, Ireland to Probe X’s Use of Personal Data for AI Training, (Apr 11, 2025)
The Irish Data Protection Commission (DPC) today announced it had begun an investigation into the lawfulness of the use of social media posts to train the Grok artificial intelligence models developed by X Corp. and its Irish subsidiary, X Internet Unlimited Co. (XIUC).
The DPC will examine whether the Grok large language models (LLMs) have been trained using data from public posts on X by residents of the European Union and European Economic Area (EEA) in violation of the EU’s General Data Protection Regulation, it said in a news release.
“Like other modern LLMs, the Grok LLMs have been developed and trained on a wide variety of data. This inquiry considers a range of issues concerning the use of a subset of this data which was controlled by XIUC—namely personal data comprised in publicly accessible posts posted on the ‘X’ social media platform by EU/EEA users,” the DPC explained.
“The Inquiry will examine compliance with a range of key provisions of the GDPR, including with regard to the lawfulness and transparency of the processing,” it added.
The DPC didn’t provide a timeline for the investigation but said XIUC had been notified of the probe.
News: InternationalLegislation DataPrivacy GDPR