X (Twitter) — Enforcement
Executive Summary
X enabled a default opt-in that automatically shared users' public posts with xAI for Grok training, without prominent notice. The opt-out was buried deep in settings. EU users were included under a 'legitimate interest' basis. The Irish DPC took X to Ireland's High Court, securing an emergency order. X agreed to permanently suspend processing EU/EEA user data for Grok training, though was not required to delete models already trained on that data.
What Happened
X (formerly Twitter) processed personal data from public posts of EU/EEA users between May 7, 2024 and August 1, 2024 to train its AI chatbot Grok, without obtaining user consent. Ireland's Data Protection Commission brought an urgent application to the Irish High Court under Section 134 of the Data Protection Act 2018, marking the first time any Lead Supervisory Authority had taken such action. X agreed in early August to suspend processing EU/EEA user data for AI training and later agreed to make this suspension permanent, leading to the court proceedings being struck out in a statement released on the date indicated.
Who Is Affected
All users of X located in the European Union and European Economic Area who had public posts on the platform between May 7, 2024 and August 1, 2024 are affected. Their personal data contained in public posts was processed for AI training purposes during this period. The undertaking X provided to the Irish court protects the rights of EU/EEA citizens going forward by permanently suspending this type of data processing.
Why It Matters
This represents the first time a Lead Supervisory Authority under GDPR has taken urgent court action to protect user data from being used for AI training without consent, establishing a new enforcement precedent. X is not alone in facing this issue, as Meta faced similar regulatory pushback in the EU and paused its data processing for AI training in June 2024. The case demonstrates that EU regulators are actively using legal tools to prevent companies from repurposing user data as AI training material without proper consent under GDPR.
AI-Assisted
Event summaries are generated by Claude AI from verified sources and reviewed by humans before publication.
Sources