Canada’s Privacy Commissioner has found that xAI’s Grok chatbot and its parent company X Corp. violated federal privacy law by launching an AI image-generation tool without adequate safeguards, enabling the creation and distribution of non-consensual sexualised deepfakes.

In a report released on Thursday (11 June), Privacy Commissioner Philippe Dufresne said the investigation (initiated in January) found that the system lacked sufficient protections to prevent misuse, resulting in the generation of millions of harmful images targeting women and children.

The Office of the Privacy Commissioner of Canada said the case highlights serious privacy risks linked to emerging AI technologies and the need for stronger regulatory safeguards at the design stage of such tools.

• Canada moves to ban social media use for children under 16

Deepfake abuse and regulatory findings

The investigation concluded that the Grok image-generation feature was deployed without proper risk assessment or sufficient technical controls to prevent exploitation.

According to the report, users worldwide were able to create and circulate sexualised deepfakes without consent, raising significant concerns about privacy violations and online harm.

The commissioner found that both X Corp. and xAI breached Canada’s federal private-sector privacy law, marking one of the most high-profile regulatory actions yet involving generative AI systems.

Following public scrutiny and during the investigation, the companies introduced additional safeguards, including detection systems aimed at identifying and removing abusive content, as well as new restrictions intended to reduce misuse.

• Canadian mother sues OpenAI over daughter's suicide

Commitments and oversight

While acknowledging the remedial steps taken, the Privacy Commissioner said further improvements are required and called for ongoing independent audits and quarterly reporting to demonstrate effectiveness in preventing harm.

The companies have committed to submitting regular compliance reports until issues involving sexualised deepfakes are fully resolved, according to the regulator.

The Office of the Privacy Commissioner said it will continue monitoring implementation of these measures to ensure compliance with Canadian privacy law.

• Azerbaijan considers social media age limits amid global move

AI and privacy regulation

Commissioner Dufresne said the case underscores the urgent need to modernise Canada’s federal privacy framework, arguing that current legislation does not provide sufficient enforcement powers, including the ability to issue binding orders or impose meaningful financial penalties.

He has also recommended introducing stronger “privacy by design” obligations and mandatory privacy impact assessments for high-risk AI systems.

The Canadian government has recently introduced legislation aimed at strengthening online safety rules for AI chatbot services and social media platforms, which the commissioner welcomed as a step toward improving protections for users, particularly minors.

The findings add to growing global scrutiny of generative AI systems and their potential misuse in creating non-consensual synthetic content.

Tags

News Grok AI X Elon Musk Canada Social Media Ban Artificial Intelligence watchdog