News release: Privacy Commissioner of Canada investigation into the Grok chatbot and sexualized deepfakes finds companies violated privacy law

Privacy Commissioner of Canada investigation into the Grok chatbot and sexualized deepfakes finds companies violated privacy law

An investigation by the Privacy Commissioner of Canada has found that Grok’s AI image-generation tool was launched without proper safeguards or sufficient consideration of potential privacy harms.

This lack of protections allowed users around the globe to create and share non-consensual, sexualized deepfakes, many targeting women and children.

In a report released today, Commissioner Philippe Dufresne found that X Corp. and xAI violated Canada’s federal private-sector privacy law.

The Commissioner initiated the investigation in January following reports that the Grok tool was being used to generate millions of sexualized deepfakes, which can have devastating consequences for victims.

After the issue came to public attention, and during the investigation, X and xAI introduced new measures, including safeguards to reduce the risk that their tool will be misused to produce sexualized deepfakes, and proactive sweeps to detect and remove this harmful content on their platforms.

While the Privacy Commissioner is encouraged by the measures that have been implemented, he has recommended additional action by the companies to further improve these measures and demonstrate their effectiveness in mitigating this issue.

In response, the companies have committed to, among other things, provide quarterly reports as well as independent third-party audit reports on improvements to safeguards with evidence to demonstrate their effectiveness. These reports are to be submitted until the issue of sexualized deepfakes is fully resolved.

The Office of the Privacy Commissioner of Canada (OPC) will continue to monitor the implementation of these commitments to ensure that the serious issues identified during the investigation are properly addressed.