Privacy regulator expresses astonishment over Elon Musk’s decision to automatically enroll user data in Grok AI’s training program

X, previously known as Twitter, subtly introduced a change allowing user information to be integrated into the training database for Grok, its AI system. This adjustment was noticed last Friday by platform users.

Developed by Elon Musk’s X as a contender against OpenAI’s widely used ChatGPT, Grok is a conversational AI or large language model (LLM) distinguished by its reduced emphasis on political correctness (featuring enhanced humor). Users wary of their personal data being utilized by Musk’s AI can explore options to disable this feature.

This initiative has garnered scrutiny from the Irish Data Protection Commission (DPC), X’s privacy regulator in Europe. In conversations with TechCrunch, the institution expressed its astonishment at X’s recent actions and stated it has initiated follow-up inquiries, waiting for a response.

“The DPC has consistently interacted with X on this topic for several months, our most recent discussion taking place just yesterday,” said DPC deputy commissioner Graham Doyle to TechCrunch. “Hence, today’s developments come as a surprise. We have reached out to X and are anticipating their reply. A further dialogue is expected at the beginning of next week.”

Overseeing X’s adherence to the European Union’s General Data Protection Regulation (GDPR), the DPC plays a crucial role. The GDPR encompasses a comprehensive law across the EU, stipulating penalties for confirmed violations that could reach up to 4% of a company’s global annual revenue.

The description next to the Grok data-sharing option, now set as the default on X, states: “Permit the use of your posts, along with your engagements, inputs, and outcomes with Grok for its training and refining.” In smaller print, it adds, “To perpetually enhance your experience, we might employ your X posts and user interactions, inputs, and outcomes with Grok for training and honing purposes”— clarifying that such data “may be shared with our service provider xAI for these objectives.”

The clarity of the language used remains uncertain, leaving doubts as to whether X intends to harness all user data for Grok’s training or solely the data pertaining to user interactions with the AI, which remains exclusive to X premium subscribers.

Regardless, the company must establish a legitimate cause under the bloc’s privacy legislation for the processing of individuals’ data within the EU—a scenario that currently appears questionable.

A similar intention by Meta to repurpose Facebook and Instagram user data for AI training was recently halted in Europe, following GDPR complaints that led to regulatory examination in both Ireland and the U.K.

The DPC anticipates updates related to the Grok AI data-sharing matter next week.

When questioning X about the legal justification it has for utilizing European users’ data to train Grok, the response from the company’s press email was a generic automated message: “Busy now, please check back later.”