PIPEDA Findings #2026-004: Commissioner-Initiated Complaint Concerning X Corp. and X.AI LLC
A commissioner-initiated federal investigation, conducted jointly with provincial privacy counterparts, into X Corp. and X.AI LLC's compliance with Canada's PIPEDA in connection with Grok's image-generation feature. The investigation found the companies enabled generation of large volumes of non-consensual sexualized deepfake images without adequate safeguards or valid consent, and details resulting remedial commitments.
Publisher
Office of the Privacy Commissioner of Canada (OPC)
Published
11 Jun 2026
Added
1 month ago
DOI
—
Key Findings
- The OPC found X Corp./X.AI failed to obtain valid consent from individuals depicted in sexualized deepfakes generated via Grok, violating PIPEDA consent principles
- The investigation characterizes the practice as inappropriate under PIPEDA subsection 5(3) given the sensitivity of the content and insufficient safeguards
- News reporting cited in the findings estimated approximately 1.8-3 million sexualized images were generated between late December 2025 and early January 2026, including over 23,000 depicting children
- The companies committed to enhanced technical safeguards, a formal privacy-risk-assessment process for new products within six months, quarterly effectiveness reporting, and annual independent third-party audits
Methodology Notes
Formal regulatory investigation under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), conducted by the federal Office of the Privacy Commissioner jointly with provincial data-protection authorities (Quebec, British Columbia, Alberta). Findings document is the OPC's official investigation report; complaint status listed as well-founded and not yet resolved as of publication, pending demonstrated safeguard effectiveness.
Sources
Office of the Privacy Commissioner of Canada (primary)
Archived snapshot (Wayback Machine) — preserved against link rot
Tags
Cite This
APA
Office of the Privacy Commissioner of Canada (OPC) (2026). PIPEDA Findings #2026-004: Commissioner-Initiated Complaint Concerning X Corp. and X.AI LLC. Office of the Privacy Commissioner of Canada (OPC). https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2026/pipeda-2026-004/