Ireland’s Data Protection Commission (DPC) has launched High Court proceedings against Elon Musk’s X, accusing the company of using European user data without proper consent to train its artificial intelligence tools, according to Irish broadcaster RTE.
The legal action concerns X’s decision to process user data to develop the next version of Grok, an AI chatbot, without adequately notifying or obtaining consent from users.
The commission’s case is based on the EU’s General Data Protection Regulation (GDPR), which mandates a valid legal basis for any data processing.
Unnotified Data Usage
In July, X implemented a change that automatically enabled a setting for all users, allowing the platform to use their public posts for AI training. This move caught the DPC by surprise, as it had been in communication with the company for several months regarding this issue.
Although X provided a help page since May instructing users on how to opt out, it did not clearly inform users that data access was enabled by default. The DPC argues that this measure is insufficient and that a significant number of European X users had their data processed without the necessary protections.
Violations of GDPR Alleged by DPC
The DPC contends that X’s use of user data to train Grok breaches its obligations under the GDPR. Specifically, the failure to offer a timely opt-out mechanism and the lack of a valid legal basis for data processing are cited as violations. According to GDPR, legal grounds for processing data include obtaining express consent or fulfilling contractual obligations. The DPC’s complaint indicates that X lacks any legal grounds for its actions.
Twitter International, X’s Irish division, has reportedly refused to halt data processing and delay the launch of Grok, prompting the DPC to seek a court order to suspend or prohibit X from using user data for AI training. If the court finds X in violation of GDPR, the company could face fines of up to 4% of its annual worldwide turnover.
The DPC is also planning to refer the matter to the European Data Protection Board (EDPB), an independent supervisory body established under GDPR that can issue guidance on the application of the law across the EU. The commission believes the issue poses an urgent risk to users’ rights and freedoms.
The legal proceedings are set to continue in the High Court next week. X has not yet responded to requests for comment. Assistant principal communications officer Risteard Byrne stated that the DPC would refrain from further comment until the matter is resolved in court.
This case follows recent regulatory actions against other tech companies. In June, Meta paused a similar plan to use user data for AI training following GDPR complaints and regulatory pressure, including from the DPC. Musk’s X, however, has been less cooperative, leading to the current legal action.
Additional Challenges for X
X is also facing additional challenges. Recently, the platform lost a case in the Netherlands related to GDPR compliance after an individual sued over issues including shadowbanning.
Additionally, the European Commission suspects X of breaching the bloc’s Digital Services Act (DSA), which imposes penalties of up to 6% of global annual turnover for noncompliance. The EU’s concerns include the misleading design of the blue check system, transparency requirements, data access for researchers, and content moderation and risk mitigation.
