Elon Musk’s X under fire over harvesting users’ data to train AI chatbot

X is facing scrutiny from its main European privacy regulator over collecting people’s posts to train its artificial intelligence chatbot, a move that may infringe upon data protection rules.
The social media platform came under fire today for harvesting users’ data for its AI chatbot Grok without notifying them or asking for consent.
The company’s lead European privacy authority said it had been engaging with X for several months and as recently as Thursday and “therefore we are surprised by today’s developments,” said Graham Doyle, spokesperson for the Irish Data Protection Commission.
The Irish watchdog followed up on the matter with X today and is awaiting an answer and further engagement early next week.
“X added a setting for ‘we’ll take your data to train grok’ without any notice and just defaulted to ‘yes’ for everyone. This is BAD,” said Kevin Schawinski, the CEO of an AI company based in Switzerland.
It’s unclear when the company rolled out this setting and started gathering its users’ posts. The social media platform currently appears to operate on the default presumption that its users are allowing the company to use data like their posts and interactions to train and fine-tune its Grok tool.
The company in November 2023 released Grok, a “rebellious” ChatGPT rival. The chatbot’s first version was not trained on X data, the company said. In March, it announced an upcoming updated chatbot — but it’s unclear which training data was being used.
Many social media platforms — from Meta and TikTok to Reddit — have been trying to leverage troves of their users’ data to build new AI products. But the feat has been harder in Europe, with privacy regulators enforcing the General Data Protection Regulation (GDPR), a law giving European citizens more rights over their personal data than those living elsewhere.
Meta in June paused its plan to collect Europeans’ posts and images on Facebook and Instagram to train its AI tools after a spate of GDPR complaints prompted renewed scrutiny from its lead Irish regulator. Google last year also had to delay the launch of its generative AI, following a request from the Irish privacy authority.
X is already being probed by the Irish Data Protection Commission in at least five cases. While the investigations started before Elon Musk bought and rebranded Twitter into X, they could potentially lead to multimillion-euro fines of up to 4 percent of the company’s annual global revenue.
X did not immediately reply to a request for comment.