Statement by the Privacy Commissioner of Canada on investigation into Grok chatbot and sexualized deepfakes

June 11, 2026
Ottawa, ON

Privacy Commissioner of Canada Philippe Dufresne today issued the following statement on his investigation into the Grok chatbot’s artificial intelligence-powered image-generation tool.

(Check against delivery)

---

Artificial intelligence and other emerging technologies are fueled by the mass collection and use of data, including personal information.

While technological innovation can bring important economic, societal, and public-interest benefits, the value of innovation can be jeopardized when it is not deployed with appropriate safeguards.

A few months ago, reports emerged that Grok’s image-generation tool was being used to generate millions of sexualized deepfakes without consent.

Given the serious risks for Canadians’ fundamental right to privacy and the potential harms, I initiated an investigation on this issue into X Corp. and xAI.

The investigation has found that X Corp. and xAI violated Canada’s federal private-sector privacy law by launching the Grok AI-powered image-generation tool without implementing appropriate safeguards from the outset.

This lack of protections allowed users to create and share sexualized deepfakes, including many targeting women and children. According to researchers, Grok was at one point generating well over 6,000 sexualized images per hour.

We know that sexualized deepfakes can have devastating impacts on victims.

Canadians – and especially our children – must be able to safely navigate online spaces. Just yesterday, the Government tabled legislation that would create new requirements for social media services and AI chatbot services.

I welcome these efforts to implement measures to make the online world a safer space.

This is also why I launched the Grok investigation.

Since the Grok issue came to public attention, and during the investigation, X Corp. and xAI have implemented safeguards to reduce the risk that the tool will be misused to produce sexualized deepfakes, as well as mechanisms to review and remove this harmful content.

In response to recommendations from my Office, the companies have committed to implement a number of additional measures. These include enhancing their formal processes for anticipating and mitigating privacy issues associated with image-generation tools and other novel products, and reporting to my Office on a recurring basis to explain and demonstrate the effectiveness of their safeguards.

While these new remedial measures and commitments are encouraging and an important outcome for Canadians, my Office will continue to monitor the implementation of the companies’ commitments to ensure that the serious issues that we found are fully addressed. Importantly, these measures should have been put in place at the outset, not after the fact and after the harm had occurred.

This case should serve as a powerful reminder for all organizations – especially those developing and deploying emerging technologies like AI – about the importance of prioritizing privacy at the outset of any initiative.

Privacy must be embedded into the conception, design, operation and management of products and services.

Appropriate safeguards are the cornerstone of responsible innovation.

This investigation demonstrates why Canada needs modernized federal privacy laws that will better support the development of trustworthy, privacy-protective technologies.

I welcome the Prime Minister’s commitment to modernize the federal private-sector privacy law to enshrine a fundamental right to privacy, safeguard children’s information from exploitation and harm, and strengthen individuals’ control over their personal information.

The first pillar in the government’s new national AI strategy announced last week is Protecting Canadians and safeguarding democracy. The strategy highlights the importance of building safe and trustworthy AI, with modernized privacy and online safety laws to support this goal.

I believe that modernized privacy laws would help build trust in AI and better support Canadians and Canadian organizations to thrive in today’s modern, data-driven world.

A new law should establish a legal obligation for organizations to implement privacy by design and to conduct privacy impact assessments for high-risk activities.

I have also called for stronger enforcement powers, including administrative monetary penalties as well as the power to issue binding orders to ensure that organizations respect Canadians’ fundamental right to privacy.

Technological innovation can bring significant economic, societal, and public interest advancements for Canada.

Harnessing this value requires that innovation be built on a strong, secure foundation – with the best interests of Canadians at its core.