Privacy commissioner says Grok deepfakes violated Canadian privacy law

OTTAWA – Sexual deepfakes created by Elon Musk’s Grok AI chatbot and shared on his X platform violated Canada’s privacy law — and while the company has made some changes, they don’t go far enough, the privacy commissioner said Thursday.

Commissioner Philippe Dufresne said Grok’s AI image generation tool was launched without adequate safeguards and didn’t properly consider harms to privacy.

“This lack of protection allowed users to create and share sexualized deepfakes, largely targeting women and children. According to researchers, Grok was at one point generating well over 6,000 sexualized images per hour,” Dufresne said.

The commissioner launched the investigation into Grok in January. It looked at whether the companies involved are complying with privacy law and whether they obtained “valid consent” to collect, use and disclose personal information to create deepfakes, including explicit content.

The investigation found both xAI, the company behind Grok, and X Corp., the company behind the social media platform X, violated Canada’s federal private sector privacy law. Both companies are owned by Musk’s SpaceX.

“One of the recommendations that we made was that they suspend the tool until they can put in place all of the appropriate safeguards. So press pause, fix the issue given the harms, and that gives an incentive to fix the issues quickly,” Dufresne said.

“They’ve not accepted to do this and I can’t force them to do it.”

He said that while the company was collaborative and did take some measures in response, it remains in non-compliance. While the number of images has been reduced, they are still available on the platform, Dufresne said.

xAI did not respond to a request for comment Thursday.

Dufresne argued the case shows the need to update Canada’s privacy law to give his office the power to issue fines and make binding orders.

“There is no ability to impose a financial consequence. There’s no ability to impose an order. That creates a lack of incentive and in some cases maybe a disincentive to comply with the fundamental right to privacy. So that’s a major gap,” he said.

Artificial Intelligence Minister Evan Solomon has said he will introduce that updated privacy law. It’s not clear whether that will happen before the House of Commons rises for the summer.

Solomon said in a media statement the privacy commissioner’s investigation “sends a clear message: every company operating in Canada must respect Canadian law, protect Canadians’ personal information, and be accountable for how their systems affect people in the real world.”

The statement added the government would have “more to say soon about our updated privacy legislation.”

Conservative public safety critic Frank Caputo said in a post on X the ruling is “yet another warning sign and another Liberal failure.”

Asked for more detail, a Conservative spokesperson said the privacy commissioner concluded the companies violated Canada’s federal private sector privacy law.

“We have laws on the books that aren’t being followed, yet the Liberal government’s solution is to give themselves new powers when they aren’t using the laws available today,” the spokesperson said.

The privacy commissioner operates independently from government and reports directly to Parliament.

The Liberal government has tried twice to update Canada’s private sector privacy law, first in 2020 and then in 2023. Neither bill became law.

Canada was among a number of countries to launch investigations into the sexualized deepfakes, alongside the U.K., the European Union and California.

“Artificial intelligence and other emerging technologies are fuelled by the mass collection and use of data, including personal information,” Dufresne said.

Dufresne welcomed efforts by the federal government to put forward an online safety bill that would regulate social media platforms and AI chatbots. Under the proposed law, companies would have a duty to act responsibly and social media platforms would have to block kids under 16. The bill, introduced Wednesday, would also create a new regulator.

The government also has put forward legislation to criminalize non-consensual sexual deepfakes which has not yet become law.

Dufresne said the companies argued users were responsible for the deepfakes and criminal law can deal with the issue.

Dufresne said “if you rely only on criminal law, it’s going to be reactive, and you’re going to have significant harm that we need to prevent.”

This report by The Canadian Press was first published June 11, 2026.