orderConcluded
Ireland Data Protection Commission (DPC) — X (formerly Twitter)
September 4, 2024 · Ireland · Social Media
The DPC concluded proceedings it brought before the Irish High Court after X agreed to permanently cease processing personal data from EU/EEA users' public posts for the purpose of training its Grok AI chatbot. This marked the first time the DPC utilized its powers under Section 134 of the Data Protection Act 2018.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.