Condita Research
← Back to catalogue/Federal (Canada)PIPEDA Findings #2026-004
Federal (Canada)Personal Information Protection and Electronic Documents ActWell-founded

PIPEDA Findings #2026-004: Commissioner-initiated complaints concerning X Corp.’s and X.AI LLC’s compliance with PIPEDA

Organization: X Corp. and X.AI LLCComplainant: Office of the Privacy Commissioner of Canada
BookmarkView Governing Law
Plain-language brief

The Office of the Privacy Commissioner of Canada (OPC) initiated complaints against X Corp. and X.AI LLC following reports that their AI chatbot, Grok, generated millions of sexualized deepfakes of identifiable individuals. The investigation focused on whether valid consent was obtained for the collection, use, and disclosure of personal information for this purpose, and if such practices were appropriate under PIPEDA. The OPC found that neither company obtained valid consent, noting the sensitive nature of the information, the unreasonableness of individuals' expectations, and the significant risk of harm. Furthermore, the OPC concluded that the generation of sexualized deepfakes was inappropriate, as the loss of privacy and harm far outweighed any benefits, and less privacy-invasive means were available. While the companies implemented some safeguards, the OPC deemed their initial response insufficient and their current measures unproven. Consequently, the matter was found well-founded, with the OPC making several recommendations for improved safeguards, proactive monitoring, and annual third-party audits, while committing to ongoing monitoring.

Key issues
  1. 1Whether PIPEDA applies to X Corp. and X.AI LLC, specifically regarding the existence of a "real and substantial connection" to Canada.
  2. 2Whether deepfakes of identifiable individuals, including sexualized deepfakes, constitute "personal information" under PIPEDA.
  3. 3Whether X Corp. and X.AI LLC obtained valid consent for the collection, use, and disclosure of personal information to generate sexualized deepfakes, as required by Principle 4.3 of PIPEDA.
  4. 4Whether express consent was required for the generation of sexualized deepfakes, considering the sensitivity of the information, individuals' reasonable expectations, and the risk of significant harm (Principle 4.3.4, 4.3.5, and s.6.1 of PIPEDA).
  5. 5Whether X Corp. and X.AI LLC are accountable for ensuring valid consent for content generated by their tools in the course of commercial activity.
  6. 6Whether a reasonable person would consider the collection, use, and disclosure of personal information for the purpose of an image generation service capable of producing sexualized deepfakes to be appropriate in the circumstances, as per subsection 5(3) of PIPEDA.
  7. 7Whether the organizations had a legitimate need or bona fide business interest that extended to providing an image generation tool capable of producing non-consensual sexualized deepfakes.
  8. 8Whether less privacy-invasive means were available to achieve the organizations' purposes at comparable cost and benefits.
  9. 9Whether the loss of privacy and risk of harm associated with sexualized deepfakes were proportionate to the benefits of the practice.
  10. 10Whether X Corp. and X.AI LLC's initial response and implemented safeguards were sufficient and effective in preventing the generation of sexualized deepfakes.
Outcome breakdownFavours: Applicant / complainant
  • Consent for collection: No valid consent obtained
  • Consent for use: No valid consent obtained
  • Consent for disclosure: No valid consent obtained
  • Appropriateness of practices: Practices deemed inappropriate
  • Sufficiency of safeguards: Initial safeguards insufficient
  • Complaint outcome: Complaint found well-founded
  • Recommendations: Recommendations made for improvements
Outcome

Well-founded — not resolved, with recommendations and ongoing monitoring

Reasoning

The OPC found that X Corp. and xAI failed to obtain valid consent for generating sexualized deepfakes and that this practice was inappropriate under PIPEDA, with their implemented safeguards deemed insufficient to fully mitigate the issue.

AI-generated summary for reference only. Always verify against the official decision ↗
Decision notes
Recommended action / remedy

The OPC recommended that X Corp. and xAI immediately suspend Grok Imagine's functionality until safeguards are proven effective, develop a formal process for anticipating privacy issues, provide annual third-party audits of safeguards, and proactively monitor for sexualized deepfakes.

Statutes considered
  • s.11(2) PIPEDA
  • Principle 4.3 PIPEDA
  • Principle 4.3.4 PIPEDA
  • Principle 4.3.5 PIPEDA
  • s.6.1 PIPEDA
  • s.5(3) PIPEDA
  • s.4(1)(a) PIPEDA

This summary is informational only and not legal advice.

Pro · AI

Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.

Pro
Coverage — 13 of 14 jurisdictions searchable

Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.

Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).

Coming soon: Nunavut — being re-processed for AI search.

Find decisions like this one — by meaning, not keywords.

Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.

Upgrade to Pro