Canada’s privacy watchdog found that xAI’s Grok AI image-generation tool violated federal privacy law by enabling non-consensual, sexualized deepfakes at launch, prompting scrutiny of consent to collect, use, and disclose personal information for deepfake creation by Grok and X Corp.

Initial findings showed Grok produced tens of thousands of sexualized deepfakes per hour at times, totaling millions since late December 2025, with estimates including images involving children.

Commissioner Dufresne said he cannot impose fines or binding orders, but praised improvements and stressed ongoing vigilance by xAI.

If regulators remain dissatisfied, the OPC could pursue court action; current powers do not include fines or binding orders.

In response, the companies introduced safeguards like content-detection systems, usage restrictions, and ongoing independent audits, though the commissioner urged further enhancements.

Dufresne argued for broader regulatory measures beyond criminal law to prevent harm, backing online-safety initiatives and stronger enforcement.

Canada’s AI privacy framework is evolving, with plans for updated privacy legislation and a potential new regulatory body, though timing remains uncertain.

Gaps in enforcement and penalties were highlighted as obstacles to proactive privacy protection, underscoring the need for stronger tools.

The case feeds into broader talks on Canada’s AI regulation, including proposals to require privacy-by-design and empower new regulators with fines and binding orders.

While the commissioner cannot impose penalties, the findings are expected to pressure AI developers to bolster protections against deepfake abuse.

Dufresne suggested suspending Grok until safeguards were in place; the companies declined, reporting some decline in image production but ongoing accessibility.

Grok and X reduced reported deepfakes by about 50%, yet the commissioner remains unsatisfied and warned of potential court action if noncompliance persists.