PIPEDA Findings #2026-004: Commissioner-Initiated Complaint Concerning X Corp. and X.AI LLC

Key Findings

• — The OPC found X Corp./X.AI failed to obtain valid consent from individuals depicted in sexualized deepfakes generated via Grok, violating PIPEDA consent principles
• — The investigation characterizes the practice as inappropriate under PIPEDA subsection 5(3) given the sensitivity of the content and insufficient safeguards
• — News reporting cited in the findings estimated approximately 1.8-3 million sexualized images were generated between late December 2025 and early January 2026, including over 23,000 depicting children
• — The companies committed to enhanced technical safeguards, a formal privacy-risk-assessment process for new products within six months, quarterly effectiveness reporting, and annual independent third-party audits

Methodology Notes

Formal regulatory investigation under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), conducted by the federal Office of the Privacy Commissioner jointly with provincial data-protection authorities (Quebec, British Columbia, Alberta). Findings document is the OPC's official investigation report; complaint status listed as well-founded and not yet resolved as of publication, pending demonstrated safeguard effectiveness.

Sources