Ireland Data Protection Commission (DPC) — X (formerly Twitter)
The DPC concluded proceedings it brought before the Irish High Court after X agreed to permanently cease processing personal data from EU/EEA users' public posts for the purpose of training its Grok AI chatbot. This marked the first time the DPC utilized its powers under Section 134 of the Data Protection Act 2018.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text.
- Decided by
- Irish High Court
- Parties
- Data Protection Commission v. X
- Decision date
- September 4, 2024
- Remedy
- X agreed to permanently adhere to the terms of its undertaking regarding the processing of EU and EEA users' personal data for training its AI tool Grok, resulting in the proceedings being struck out.
- Appeal
- Appeal status not stated
Key holdings
The Irish High Court proceedings brought by the DPC against X were struck out based on X's agreement to permanently maintain its undertaking.
“proceedings have been struck-out on the basis of X’s agreement to continue to adhere to the terms of the undertaking”
The DPC initiated court action due to concerns that processing EU and EEA users' public posts to train Grok endangered fundamental rights and freedoms.
“processing of personal data contained in the public posts of X’s EU/EEA users for the purpose of training its AI ‘Grok’ gave rise to a risk”
The DPC submitted a request to the European Data Protection Board under Article 64(2) GDPR to foster consistent regulation on AI model training.
“Today, the DPC is making a request to the European Data Protection Board (the EDPB) for an opinion pursuant to Article 64(2) GDPR”
In plain English
On August 8, 2024, the Irish Data Protection Commission brought urgent proceedings in the Irish High Court against X under Section 134 of the Data Protection Act 2018. The regulatory action was taken due to significant concerns regarding X's processing of personal data contained in the public posts of its European Union and European Economic Area users for the purpose of training its artificial intelligence tool, Grok. The Data Protection Commission found that this processing gave rise to a risk to the fundamental rights and freedoms of individuals. On September 4, 2024, the proceedings were struck out after X agreed on a permanent basis to adhere to the terms of the undertaking previously agreed upon. This marked the first time the Data Protection Commission, acting as the Lead Supervisory Authority across the EU and EEA, utilized its powers under Section 134 of the Data Protection Act 2018 to apply for a court order restricting data processing. Additionally, to address broader issues concerning personal data usage in artificial intelligence models, the Data Protection Commission requested an opinion from the European Data Protection Board under Article 64(2) of the General Data Protection Regulation. This request aims to facilitate discussion and agreement among European regulators on core legal issues involving AI training data and support the handling of related complaints against various data controllers.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.