Ireland opens probe into Musk’s X over Grok’s AI data slurp
(2025/04/14)
- Reference: 1744649536
- News link: https://www.theregister.co.uk/2025/04/14/ireland_investigation_into_x/
- Source link:
Elon Musk's social media outfit X is again under the regulatory microscope in Europe – this time for allegedly using EU users' public posts to train its Grok AI chatbot, possibly without the transparency or legal basis required under the General Data Protection Regulation (GDPR).
The Irish Data Protection Commission (DPC) [1]announced Friday that it had kicked off an inquiry into X Internet Unlimited Company (XIUC) - the newly renamed Irish entity responsible for Elon Musk's social media platform. The investigation seeks to determine whether XIUC's processing of publicly accessible posts from EU users to train its Grok AI models complies with the GDPR.
Notably, XIUC became the official data controller for EU users on April 1, following a rebranding from Twitter International Unlimited Company (TIUC), as part of the transition from Twitter to X.
[2]
Like many social media platforms exploring AI, X utilizes user-generated content to train machine learning models. Specifically, X shares publicly accessible data - including posts, profiles, and user interactions - with xAI to develop and refine Grok, the chatbot now embedded in the platform. This practice has raised privacy concerns, as users were initially opted in by default, leading to scrutiny over compliance with data protection regulations.
[3]
[4]
The tie-up between X and xAI became even closer in March, when xAI acquired the social media platform in [5]an all-stock deal valued at $33 billion. This merger puts both the data and the AI engine under the same Musk-controlled roof.
"This inquiry considers a range of issues concerning the use of a subset of this data which was controlled by XIUC - namely personal data comprised in publicly accessible posts posted on the 'X' social media platform by EU/EEA users," The DPC said. "The purpose of this inquiry is to determine whether this personal data was lawfully processed in order to train the Grok LLMs."
[6]
Companies in control of LLMs have regularly come under scrutiny from EU regulators and member states over their data processing practices. OpenAI, for example, has [7]faced GDPR complaints alleging that ChatGPT provides inaccurate information about individuals and lacks a way to correct it, potentially violating the right to rectification. Meanwhile, the EU has become the first jurisdiction to pass [8]comprehensive AI legislation : the Artificial Intelligence Act.
[9]Euro banks worry AI will increase their dependence on US big tech
[10]Elon Musk's X isn't important enough to feel the full force of EU regulation
[11]EU lands 25% counter tariff punch on US, Trump pauses broad import levy hike – China excepted
[12]EU demands a peek under the hood of X's recommendation algorithms
X isn't any stranger to EU investigations either, with Musk's personal social media platform becoming [13]one of the first companies to face formal proceedings under the EU's Digital Services Act. The European Commission launched an inquiry in late 2023 over concerns that X may have been falling short on obligations around risk management, content moderation, and algorithmic transparency — requirements it must meet as a designated Very Large Online Platform (VLOP) under the DSA, due to its significant reach and influence.
The investigation into X comes against a backdrop of rising transatlantic trade tensions. The Trump administration's [14]fluctuating tariff policies have [15]introduced significant uncertainty into global trade. In response, the EU has floated potential countermeasures targeting US companies, should trade negotiations break down. While the timing of the DPC's probe into X overlaps with these developments, there's no indication the two are directly connected.
The DPC confirmed to The Register that the investigation has no connection to ongoing trade tensions and said it has been examining the issue since last summer. We've also reached out to X to get its take, but haven't heard back. ®
Get our [16]Tech Resources
[1] https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-commencement-inquiry-x-internet-unlimited-company-xiuc
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z_2FazzVZggAx8dtVS7uuAAAAMI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_2FazzVZggAx8dtVS7uuAAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z_2FazzVZggAx8dtVS7uuAAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/03/31/xai_acquires_x/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_2FazzVZggAx8dtVS7uuAAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/04/29/openai_hit_by_gdpr_complaint/
[8] https://www.theregister.com/2024/03/13/eu_ai_act/
[9] https://www.theregister.com/2024/06/10/euro_banks_worry_ai_us_tech/
[10] https://www.theregister.com/2024/10/17/eu_x_dma_regulation/
[11] https://www.theregister.com/2025/04/09/eu_tariffs/
[12] https://www.theregister.com/2025/01/17/eu_x_algorithm_changes/
[13] https://www.theregister.com/2023/12/18/eu_x_investigation/
[14] https://www.theregister.com/2025/04/14/tech_tariff_update/
[15] https://www.theregister.com/2025/04/14/trump_trade_war_jefferies/
[16] https://whitepapers.theregister.com/
The Irish Data Protection Commission (DPC) [1]announced Friday that it had kicked off an inquiry into X Internet Unlimited Company (XIUC) - the newly renamed Irish entity responsible for Elon Musk's social media platform. The investigation seeks to determine whether XIUC's processing of publicly accessible posts from EU users to train its Grok AI models complies with the GDPR.
Notably, XIUC became the official data controller for EU users on April 1, following a rebranding from Twitter International Unlimited Company (TIUC), as part of the transition from Twitter to X.
[2]
Like many social media platforms exploring AI, X utilizes user-generated content to train machine learning models. Specifically, X shares publicly accessible data - including posts, profiles, and user interactions - with xAI to develop and refine Grok, the chatbot now embedded in the platform. This practice has raised privacy concerns, as users were initially opted in by default, leading to scrutiny over compliance with data protection regulations.
[3]
[4]
The tie-up between X and xAI became even closer in March, when xAI acquired the social media platform in [5]an all-stock deal valued at $33 billion. This merger puts both the data and the AI engine under the same Musk-controlled roof.
"This inquiry considers a range of issues concerning the use of a subset of this data which was controlled by XIUC - namely personal data comprised in publicly accessible posts posted on the 'X' social media platform by EU/EEA users," The DPC said. "The purpose of this inquiry is to determine whether this personal data was lawfully processed in order to train the Grok LLMs."
[6]
Companies in control of LLMs have regularly come under scrutiny from EU regulators and member states over their data processing practices. OpenAI, for example, has [7]faced GDPR complaints alleging that ChatGPT provides inaccurate information about individuals and lacks a way to correct it, potentially violating the right to rectification. Meanwhile, the EU has become the first jurisdiction to pass [8]comprehensive AI legislation : the Artificial Intelligence Act.
[9]Euro banks worry AI will increase their dependence on US big tech
[10]Elon Musk's X isn't important enough to feel the full force of EU regulation
[11]EU lands 25% counter tariff punch on US, Trump pauses broad import levy hike – China excepted
[12]EU demands a peek under the hood of X's recommendation algorithms
X isn't any stranger to EU investigations either, with Musk's personal social media platform becoming [13]one of the first companies to face formal proceedings under the EU's Digital Services Act. The European Commission launched an inquiry in late 2023 over concerns that X may have been falling short on obligations around risk management, content moderation, and algorithmic transparency — requirements it must meet as a designated Very Large Online Platform (VLOP) under the DSA, due to its significant reach and influence.
The investigation into X comes against a backdrop of rising transatlantic trade tensions. The Trump administration's [14]fluctuating tariff policies have [15]introduced significant uncertainty into global trade. In response, the EU has floated potential countermeasures targeting US companies, should trade negotiations break down. While the timing of the DPC's probe into X overlaps with these developments, there's no indication the two are directly connected.
The DPC confirmed to The Register that the investigation has no connection to ongoing trade tensions and said it has been examining the issue since last summer. We've also reached out to X to get its take, but haven't heard back. ®
Get our [16]Tech Resources
[1] https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-commencement-inquiry-x-internet-unlimited-company-xiuc
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z_2FazzVZggAx8dtVS7uuAAAAMI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_2FazzVZggAx8dtVS7uuAAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z_2FazzVZggAx8dtVS7uuAAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2025/03/31/xai_acquires_x/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z_2FazzVZggAx8dtVS7uuAAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/04/29/openai_hit_by_gdpr_complaint/
[8] https://www.theregister.com/2024/03/13/eu_ai_act/
[9] https://www.theregister.com/2024/06/10/euro_banks_worry_ai_us_tech/
[10] https://www.theregister.com/2024/10/17/eu_x_dma_regulation/
[11] https://www.theregister.com/2025/04/09/eu_tariffs/
[12] https://www.theregister.com/2025/01/17/eu_x_algorithm_changes/
[13] https://www.theregister.com/2023/12/18/eu_x_investigation/
[14] https://www.theregister.com/2025/04/14/tech_tariff_update/
[15] https://www.theregister.com/2025/04/14/trump_trade_war_jefferies/
[16] https://whitepapers.theregister.com/
Eclectic Man
I wonder if it is even theoretically possible to 'remove' data used illegally to train a major AI system. I realise that , scrapping all the databases and re-training them from legally sourced data is what should happen, but could that actually be done? AI's have changed over only a few years based on the results of earlier use of illegally obtained data, so could that be undone? In any case it would be incredibly expensive, so expensive that probably no fine under the GDPR could be more expensive than the cost of actually removing illegally obtained data from the models.
Any suggestions?
Anonymous Coward
Well, since it's the Irish authorities, they will be keen not to offend either US tech companies, nor the Orange-utan......
Isn't XIUC...
Alien Doctor 1.1
pronounced "fuck" in Greek or something?
Re: Isn't XIUC...
Anonymous Coward
Isn't it more like "cuck"?
MachDiamond
The ToS for Xitter has the user agree to give them all rights to whatever the user posts. No infringement.
IGotOut
How many times.
ToS / EULA's / Consumer contracts, whatever, mean absolutely fuck all.
The law is the law.
You cannot put something in a ToS to allow you break the law, no more than I could write a EULA that states I have the right to shoot you in the face on a Thursday
Anonymous Coward
You can totally write a EULA that says that. It just would not be an enforceable provision and depending on the rest of the EULA and controlling law, might invalidate the rest. Or not.
Put that fascist right the hell out of business before he interferes with any more elections...