Social media giant X is facing nine GDPR complaints from privacy advocate group NOYB (None of Your Business) over the company’s use of personal data from 60 million European users to train its AI large language model ‘Grok’.

According to NOYB, which was founded by prolific data privacy advocate Max Schrems, X failed to inform users that their personal data, including their posts and likes, was being used to train the company’s AI, and they did not ask for user consent.

On X’s settOn X’s settings, Grok can train on users’ posts by default, with a box saying “Allow your posts as well as your interactions, inputs, and results with Grok be used for training and fine” automatically turned on.ings, Grok can train on users’ posts by default, with a box saying “Allow your posts as well as your interactions, inputs, and results with Grok be used for training and fine” automatically turned on.

The revelation prompted swift replies from UK and EU regulators alike, with the UK’s Information Commissioner’s Office (ICO) saying companies must take the steps to gain user consent to train AI models.

The Irish Data Protection Commission (DPC), the EU data protection subsidiary with direct jurisdiction over X, noted their “surprise” at the policy, which is in direct violation of GDPR regulations.

Recommended reading

• Demystifying GDPR & AI: Safeguarding Personal Data in the Age of LLMs
• Meta Delays AI Training in Europe Following Regulatory Concern
• X’s Default Data Harvesting for AI Model Under Regulatory Scrutiny

Under both UK and EU GDPR, users must consent to their data being processed and trained by AI, and have the full authority to refuse consent. Further, the condition should be an opt-in, not an opt-out. By automatically opting users in to having their data scraped for AI training, X appears to be in violation of GDPR.

Following the Irish DPC’s lacklustre response, Schrems filed multiple GDPR complaints against X for a range of violations, hoping for a full investigation into X’s practices.

The filings seek to find out why X failed to inform consumers about the training, what happened to EU data that has already been used, and how to separate EU and non-EU data.

Max Schrems, chairman of NOYB said: “We have seen countless instances if inefficient and partial enforcement by the DPC in the past years. We want to ensure that Twitter [X] fully complies with EU law, which – at a bare minimum – requires to ask users for consent in this case.”