Data Protection Commission (DPC) — X Internet Unlimited Company (Grok)
The DPC commenced an inquiry into X's processing of EU/EEA users' public posts to train its Grok large language models, examining the lawfulness of using personal data from publicly accessible posts for generative-AI training.
Key takeaway — how to prevent this
AI services need a lawful basis, transparency and (for minors) age verification before launch in regulated markets — several DPAs blocked AI products first and asked questions later.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text.
- Decided by
- Data Protection Commission
- Parties
- Data Protection Commission v. X Internet Unlimited Company
- Appeal
- Appeal status not stated
Key holdings
The Data Protection Commission initiated an inquiry into X Internet Unlimited Company concerning compliance with GDPR lawfulness and transparency requirements.
“The Inquiry will examine compliance with a range of key provisions of the GDPR, including with regard to the lawfulness and transparency of the processing.”
The inquiry specifically targets the processing of EU and EEA users' public X posts used to train Grok Large Language Models.
“The purpose of this inquiry is to determine whether this personal data was lawfully processed in order to train the Grok LLMs.”
In plain English
On April 11, 2025, Ireland's Data Protection Commission announced the commencement of an inquiry into X Internet Unlimited Company, formerly known as Twitter International Unlimited Company. The inquiry focuses on XIUC's processing of personal data contained in publicly accessible posts on the X social media platform made by users in the European Union and European Economic Area. Specifically, the regulatory investigation addresses the use of this personal data for training generative artificial intelligence models, particularly the Grok Large Language Models developed by xAI. The Data Protection Commission aims to examine XIUC's compliance with core provisions of the General Data Protection Regulation, specifically focusing on the lawfulness and transparency of the data processing activities. The decision to initiate this statutory inquiry under Section 110 of the Data Protection Act 2018 was made by Commissioners for Data Protection Dr. Des Hogan and Dale Sunderland, who notified XIUC of the decision. On March 25, 2025, XIUC had informed the DPC that effective April 1, 2025, its corporate name and status as the data controller for EU users of X changed from Twitter International Unlimited Company to X Internet Unlimited Company as part of ongoing rebranding efforts. The outcome will determine if training AI models on public user posts complies with European data protection law.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.