On 27 July 2024 various media outlets reported that the Irish Data Protection Commission is investigating X for its decision to share user data with Elon Musk’s AI startup, xAI, without obtaining consent. This practice allows xAI to train its AI assistant, Grok, using data from X users.
The change was discovered by users on 26 July 2024. The default sharing setting can only be changed via the desktop version of X, with plans to add a mobile app option.
The Irish Data Protection Commission had been engaging with X about its data usage plans for months. The sudden rollout surprised the DPC, leading to further inquiries and the possibility of a GDPR probe.
Meta faced similar scrutiny from the DPC, leading to a pause in its plans to use European user data for AI training.
Important note on consent – it is widely misreported that GDPR requires consent for use of data, which is why X and Meta are under fire. This is wrong. GDPR Article 6 requires entities to have a legal basis when they process data, consent being only one of six such legal bases. However, the only two legal bases that can work in the context of AI training are the controller’s legitimate interest (Art. 6.1.f), or consent of the individuals concerned (Art. 6.1.a). Using legitimate interest as a legal basis requires that the rights and interest of the individuals do not override controller’s interest, which means a case by case legitimate interest assessment needs to be performed. Various data protection authorities in the EU have already stated that it is unlikely that AI training can be done under the legitimate interest basis.
Further reading on this topic:
CNIL AI sheet on legitimate interest in AI training (under consultation).
EDPB’s Taskforce Report on ChatGPT;
