Privacy commissioner says Grok deepfakes violated Canadian privacy law

Tech and cybersecurity expert Ritesh Kotak comments on the legal limitations revealed by the federal investigation into sexual deepfakes created by Grok.

OTTAWA -- Sexual deepfakes created by Elon Musk’s Grok AI chatbot and shared on his X platform violated Canada’s privacy law and while the company has made some changes they don’t go far enough, the privacy commissioner said Thursday.

Philippe Dufresne said Grok’s AI image generation tool was launched without adequate safeguards and didn’t properly consider harms to privacy.

“This lack of protection allowed users to create and share sexualized deepfakes, largely targeting women and children. According to researchers, Grok was at one point generating well over 6,000 sexualized images per hour,” Dufresne said.

The commissioner launched the investigation into Grok in January. It looked at whether the companies involved are complying with privacy law and whether they obtained “valid consent” to collect, use and disclose personal information to create deepfakes, including explicit content.

The investigation found both xAI, the company behind Grok, and X Corp., the company behind the social media platform X, violated Canada’s federal private sector privacy law. Both companies are owned by Musk’s SpaceX.

“One of the recommendations that we made was that they suspend the tool until they can put in place all of the appropriate safeguards. So press pause, fix the issue given the harms, and that gives an incentive to fix the issues quickly,” Dufresne said.

“They’ve not accepted to do this and I can’t force them to do it.”

He said that while the company was collaborative and did take some measures in response, it remains in non-compliance. While the number of images has been reduced, they are still available on the platform, Dufresne said.

Dufresne argued the case shows the need to update Canada’s privacy law to give his office the power to issue fines and make binding orders.

“There is no ability to impose a financial consequence. There’s no ability to impose an order. That creates a lack of incentive and in some cases maybe a disincentive to comply with the fundamental right to privacy. So that’s a major gap,” he said.

Artificial Intelligence Minister Evan Solomon has said he will introduce that updated privacy law. It’s not clear whether that will happen before the House of Commons rises for the summer.

The Liberal government has tried twice to update Canada’s private sector privacy law, first in 2020 and then in 2023. Neither bill became law.

Canada was among a number of countries to launch investigations into the sexualized deepfakes, alongside the U.K., the European Union and California.

“Artificial intelligence and other emerging technologies are fuelled by the mass collection and use of data, including personal information,” Dufresne said.

Dufresne welcomed efforts by the Liberal government to put forward an online safety bill that would regulate social media platforms and AI chatbots. Under the proposed law, companies would have a duty to act responsibly and social media platforms would have to block kids under 16. The bill, introduced Wednesday, would also create a new regulator.

The government also has put forward a crime bill that would criminalize non-consensual sexual deepfakes, which has not yet become law.

Dufresne said the companies argued that users were responsible for the deepfakes and criminal law can deal with the issue.

Dufresne said “if you rely only on criminal law, it’s going to be reactive, and you’re going to have significant harm that we need to prevent.”

This report by The Canadian Press was first published June 11, 2026.

Anja Karadeglija, The Canadian Press