Artificial Intelligence & Machine Learning
,
Data Privacy
,
Data Security
GrokAI Non-Consensual Sexual Imagery Raises Official Hackles
European regulatory pressure on Elon Musk’s X social media network intensified this week with new probes into potential breaches of privacy roles by Grok AI chatbot.
See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense
The Irish Data Protection Commission on Tuesday opened an investigation into Grok’s generation and publication of non-consensual intimate and sexualized imagery of real people, including children. X’s European headquarters are in Dublin, giving the Irish agency oversight powers of the company’s compliance with European privacy law.
Deputy Commissioner Graham Doyle said the Irish watchdog had been talking to X since media reports emerged at the start of the year about Grok letting users generate and publish images of adults and children with their clothes removed. He told Information Security Media Group that X had been cooperative in these discussions.
X claims to have stopped Grok from outputting the offending images, but a Reuters investigation earlier this month showed the chatbot was still generating them, even when explicitly told that the subjects of the images had not consented. Brazil’s data protection authority subsequently determined that X’s curbs weren’t working, and on Wednesday ordered the company to immediately put a stop to Grok’s behavior. It gave X five business days to comply.
The European Commission announced in late January that it was formally investigating X over the issue, to see if it had contravened the Digital Services Act, which tells large online platforms how to tackle illegal content. That probe is focusing on whether Musk’s social network had “properly assessed and mitigated risks associated with the deployment of Grok’s functionalities into X in the EU.”
But the EU tackling the issue from a data-protection standpoint is new. It follows a similar move from the U.K.’s Information Commissioner’s Office at the start of this month, which in turn came after the opening of a content-rules-focused probe by the British communications regulator, Ofcom. On the same day as the ICO investigation opened, Paris prosecutors also raided X’s offices while investigating the scandal (see: Police Raid Elon Musk’s X Paris Office in Criminal Probe).
Spanish Prime Minister Pedro Sánchez announced Tuesday morning that his government was requesting an investigation by public prosecutors – not only of X, but also of Meta and TikTok, which he said may also be involved in the “creation and dissemination of child pornography by means of their AI.”
“These platforms threaten the mental health, dignity and rights of our sons and daughters,” Sánchez wrote in an X post. “The state cannot allow it. The impunity of the giants must end.”
None of the companies had responded to a request for comment by the time of publication.
Sánchez had already gone on the offensive against X earlier this month, when he promised to make social media executives personally liable for the spread of hate speech and other illegal content. He has recently clashed with Musk over the Spanish government’s decision to regularize around 500,000 undocumented immigrants.
Musk made X a subsidiary of his xAI company back in March of last year. Earlier this month, SpaceX bought xAI in an all-stock transaction, making Grok’s regulatory troubles an issue for the mogul’s rocket firm, which is expected to float on the public markets later this year.
If the Irish DPC decides that X has violated the General Data Protection Regulation, it can levy a fine of up to 4% of annual worldwide revenues. Violations of the EU’s Digital Services Act can earn fines running as high as 6% – X was the recipient of the Commission’s first DSA non-compliance decision back in December, when it was fined 120 million – $142 million – for deceptive practices and a lack of transparency.
The U.K.’s version of the GDPR also carries a 4% theoretical maximum fine, but the British Online Safety Act – under which Ofcom is investigating X – allows fines running up to 10% of global annual revenues.