Canada’s Privacy Commissioner says X and xAI broke privacy law over Grok sexualized deepfakes

On June 11, 2026, Canada’s Privacy Commissioner announced that X Corp. and xAI violated federal privacy law due to the insufficient safeguards surrounding the Grok AI image-generation tool. The investigation concluded that the platform enabled the creation and dissemination of non-consensual sexualized deepfakes of identifiable individuals.

What happened

The investigation, launched in January 2026, determined that Grok was introduced without adequate consideration of the privacy risks or protections against harmful content. A central finding of the report is that deepfakes of identifiable people constitute personal information, meaning companies cannot evade responsibility by attributing the generation of content solely to users. The Commissioner established that X and xAI failed to obtain valid consent from the individuals depicted in the sexualized images and that a reasonable person would deem this use of personal information inappropriate.

While the companies disagreed with the Commissioner's conclusions, the matter has been classified as well-founded. In response to the findings, the companies have committed to providing quarterly progress reports and undergoing independent third-party audits. The Commissioner noted that while some steps have been taken to restrict the editing of images in inappropriate contexts, the current safeguards were initially insufficient. This ruling highlights a significant regulatory stance, framing AI image tools not merely as a content moderation challenge, but as a critical issue of privacy, consent, and product design. Although the Office of the Privacy Commissioner currently lacks the authority to impose administrative monetary penalties or issue binding orders, the decision marks a significant escalation in international scrutiny regarding the responsibility of AI developers for the misuse of their technology.