DPC uses its urgent High Court power for the first time; X’s undertaking on Grok training data is made permanent and the proceedings are struck out
Subject: X (operator of the X social platform)
What happened
X used personal data contained in the public posts of EU/EEA users to train its AI tool Grok. The Irish DPC considered the processing gave rise to significant risk to individuals’ fundamental rights and freedoms, noting that X only put in place the enhanced mitigation measures it itself accepted were necessary months after the processing began, and did not roll them out to all users immediately.
How it was handled
On 8 August 2024 the DPC applied to the Irish High Court under section 134 of the Data Protection Act 2018 for an order suspending, restricting or prohibiting the processing — the first time the DPC, as EU/EEA lead supervisory authority, had used that power. X gave an undertaking to the Court.
Outcome
On 4 September 2024 the proceedings were struck out on the basis of X’s agreement to adhere to the undertaking permanently. The same day the DPC requested an EDPB opinion under Art. 64(2) GDPR on processing personal data for the development and training of AI models, including how to assess the legal basis relied on across first-party and third-party data. Note that the DPC release does not publish the terms of the undertaking, so the verifiable outcome is that the undertaking was made permanent and the proceedings ended — not that X permanently ceased the training in question. This case is also not a fining decision.
What it means for Chinese exporters
- · "Ship first, add mitigations as you go" is a pattern that can be stopped on an urgent basis in the EU. If user-generated content is going into a training set, the legal-basis analysis, the legitimate-interests assessment and the objection mechanism must be in place and evidenced before the first batch enters the training pipeline.
- · "Publicly visible" does not mean "free to train on". Public posts are still personal data and still need an Art. 6 basis; "the users posted it publicly themselves" did not stop the urgent procedure here.
- · EU regulators do not have to wait for a fine procedure to conclude before halting a business activity. Build a regulatory kill switch into the product plan: the ability to turn off training-data collection per jurisdiction within days, plus a demonstrable path to isolate and delete data already collected.
Related regulations
Sources (1)
- Irish DPC welcomes conclusion of High Court proceedings on X’s AI tool GrokData Protection Commission of Ireland (DPC) · published 2024-09-04 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.