Privacy commissioner says Grok deepfakes violated Canadian privacy law

Sexual deepfakes created by Elon Musk’s Grok AI chatbot and shared on his X platform violated Canada’s privacy law and while the company has made some changes they don’t go far enough, the privacy commissioner said Thursday.

Philippe Dufresne said Grok’s AI image generation tool was launched without adequate safeguards and didn’t properly consider harms to privacy.

“This lack of protection allowed users to create and share sexualized deepfakes, largely targeting women and children. According to researchers, Grok was at one point generating well over 6,000 sexualized images per hour,” Dufresne said.

The commissioner launched the investigation into Grok in January. It looked at whether the companies involved are complying with privacy law and whether they obtained “valid consent” to collect, use and disclose personal information to create deepfakes, including explicit content.

The investigation found both xAI, the company behind Grok, and X Corp., the company behind the social media platform X, violated Canada’s federal private sector privacy law. Both companies are owned by Musk’s SpaceX.

“One of the recommendations that we made was that they suspend the tool until they can put in place all of the appropriate safeguards. So press pause, fix the issue given the harms, and that gives an incentive to fix the issues quickly,” Dufresne said.

“They’ve not accepted to do this and I can’t force them to do it.”

He said that while the company was collaborative and did take some measures in response, it remains in non-compliance.

Dufresne said the case shows the need to update Canada’s privacy law to give his office the power to issue fines and make binding orders.

Artificial Intelligence Minister Evan Solomon has said he will introduce that updated privacy law. It’s not clear whether that will happen before the House of Commons rises for the summer.

The Liberal government has tried twice to update the private sector privacy law. Neither bill became law.

Canada was among a number of countries to launch investigations into the sexualized deepfakes, alongside the U.K., the European Union and California.

“Artificial intelligence and other emerging technologies are fuelled by the mass collection and use of data, including personal information,” Dufresne said.

By Anja Karadeglija