Elon Musk-owned social media platform X, is facing a wave of privacy complaints in the European Union (EU) after it was revealed that the platform used user data without obtaining consent.
The complaints allege that X harvested and utilized the personal information of its users across the EU to improve its Artificial Intelligence system Grok, violating stringent data protection laws in the process.
It is understood that last month, an X user @EasyBakedOven spotted a setting on the platform which hinted users to allow their posts, inputs, and results, to be used for training and fine tuning X. According to the user, X failed to announce such update publicly.
Tekedia Mini-MBA edition 16 (Feb 10 – May 3, 2025) opens registrations; register today for early bird discounts.
Tekedia AI in Business Masterclass opens registrations here.
Join Tekedia Capital Syndicate and invest in Africa’s finest startups here.
The user wrote,
“Twitter just activated a setting by default for everyone that gives them the right to use your data to train from. They never announced it. You can disable this using the web but it’s hidden. You can’t disable using the mobile app”.
This revelation prompted a reaction from the Irish Data Protection Commission (DPC), the watchdog that leads on oversight of X’s compliance with the bloc’s General Data Protection Regulation (GDPR). The GDPR which governs data privacy in the EU, mandates that companies must obtain explicit consent from users before collecting and processing their personal data, especially for purposes as sensitive as Al training.
The alleged failure of X to secure users’ consent has triggered a significant backlash and could lead to substantial penalties under the GDPR. The issue has drawn attention to the broader concerns surrounding data privacy and the ethical use of Al, particularly in the context of large-scale social media platforms.
Commenting in a statement, Max Schrems, chairman of privacy rights nonprofit noyb said,
“We have seen countless instances of inefficient and partial enforcement by the PC in the past years. We want to ensure that X fully complies with EU law, which at a bare minimum requires to ask users for consent in this case. Companies that interact directly with users simply need to show them a yes/no prompt before using their data. They do this regularly for lots of other things, so it would definitely be possible for AI training as well”.
Notably, the DPC has already taken some action over X’s processing for Al model training, instigating legal action in the Irish High Court seeking an injunction to force it to stop using the data. But noyb contends that the DPC’s actions thus far are insufficient, pointing out that there’s no way for X users to get the company to delete “already ingested data.” In response, noyb has filed GDPR complaints in Ireland and seven other countries.
The complaints argue that X does not have a valid basis for using the data of some 60 million people in the EU to train Als without obtaining their consent. The platform appears to be relying on a legal basis that’s known as “legitimate interest” for the Al-related processing. However privacy experts say it needs to obtain people’s consent.
If found violating EU regulations, X could face hefty fines and be required to change its data handling practices to ensure compliance with privacy laws. This controversy also raises questions about transparency in Al development and the responsibility of tech companies to protect user privacy while advancing their technological capabilities.
As the investigation unfolds, it could set a precedent for how data is managed and utilized by social media platforms and other tech companies operating in the EU.