Twitter X Grok Training Data: Posts Used for AI Without User Consent

X, formerly Twitter, began using user posts to train its Grok AI chatbot by default without notifying users or obtaining consent. The setting was enabled silently, buried deep in privacy controls, and only discovered by privacy researchers who noticed the new toggle. Users had to navigate through Settings > Privacy and Safety > Grok > toggle off to prevent their posts from being used as AI training data. European data protection authorities, led by the Irish DPC, intervened and required X to pause using EU user data for Grok training pending a compliance review. The incident highlighted a pattern under Elon Musk's ownership of treating user-generated content as a corporate asset for AI development. X's updated terms of service granted the company broad rights to use content for machine learning, and privacy advocates warned that even deleted posts may have already been ingested into training datasets before users could opt out.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.