Canada’s Privacy Commissioner Philippe Dufresne reported that xAI’s Grok AI-powered image generator was launched without proper safeguards, enabling users to create and share sexualized deepfake images without consent, violating Canadian federal private sector privacy law [1, 2, 3]. Dufresne stated, "xAI violated Canada’s federal private sector privacy law by launching the Grok AI-powered image generation tool without implementing appropriate safeguards from the outset" [1].

The findings come from a probe initiated by the Canadian Privacy Commissioner in January 2026 and publicly released on June 11, 2026 [1, 3]. The investigation revealed serious shortcomings in xAI’s handling of user privacy from the launch of the Grok image generator.

While the Privacy Commissioner highlighted these violations, he does not have authority to impose fines or enforce mandatory policy changes on xAI, which is a subsidiary of SpaceX and is preparing to go public on US markets [1]. Canadian regulators require xAI and its owner platform, X, to adopt Privacy by Design principles early in AI development to better protect users’ privacy in future products [2].

The report adds to growing international scrutiny of Grok and xAI related to sexualized deepfake content. Investigations have been launched across Europe, including the UK, Spain, and the Netherlands, since early 2026. In March, a Dutch court ordered xAI to stop allowing nude deepfake creation [1]. In June, the UK media regulator Ofcom also began probing Grok [1].

xAI said it is committed to continuously monitoring the Grok platform for sexualized deepfakes, not just reacting to individual complaints [1]. However, Elon Musk and xAI have not yet issued a formal response to the Canadian Privacy Commissioner’s report [3].

Previous privacy concerns involving the X platform include an EU investigation over training AI with user posts without consent [2].

The Canadian Privacy Commissioner’s report published on June 11 marks the latest formal step in ongoing regulatory scrutiny of Grok AI’s privacy compliance across multiple jurisdictions [1, 3].