On June 11, 2026, Privacy Commissioner Philippe Dufresne released findings that X Corp. and xAI violated PIPEDA by launching Grok’s AI image-generation tool without adequate safeguards or a timely privacy impact assessment. The tool enabled users to create millions of non-consensual sexualized deepfakes – at one point generating over 6,000 such images per hour – many targeting women and children.
The investigation found that Grok Imagine’s privacy impact assessment was not completed until March 2026, months after the tool’s July 2025 launch, and that it “did not accurately reflect” the risks to security, safety and privacy. The Office of the Privacy Commissioner of Canada (OPC) recommended that xAI suspend the image generator entirely until safeguards could be demonstrated, but the companies refused. They did, however, commit to quarterly reports and independent third-party audits until the issue is resolved.
This decision underscores what others in this space have been calling a “course correction” moment for Canadian privacy enforcement. Despite finding clear PIPEDA violations, the OPC cannot impose fines or issue binding orders to compel compliance. The Commissioner has repeatedly advocated for administrative monetary penalties (AMPs) and order-making powers to bring Canada in line with international counterparts.
The Grok decision is a clear signal: Canadian regulators expect organizations deploying AI to demonstrate they considered privacy harms before launch. The OPC may lack fines today, but it has reputational leverage, international coordination with regulators in the UK, EU and beyond and legislative reform on the horizon. Building your AI governance frameworks before it is required by regulatory frameworks will enable you to proactively minimize risk to your organization.
As AI and emerging technologies continue to transform industries, the need for specialized legal services in this domain is becoming increasingly important. The MLT Aikins AI and Emerging Technology practice group provides critical guidance on navigating the complex regulatory landscape, managing risks and ensuring ethical and lawful use of innovative technologies.
Note: This article is of a general nature only and is not exhaustive of all possible legal rights or remedies. In addition, laws may change over time and should be interpreted only in the context of particular circumstances such that these materials are not intended to be relied upon or taken as legal advice or opinion. Readers should consult a legal professional for specific advice in any particular situation.
Get legal insights, updates and event invites delivered to your inbox each week.
Our offices are located on the territories of Indigenous peoples, including the First Nations of Treaties 1, 4, 6 and 7, the Coast Salish peoples as well as other non-Treaty First Nations and Métis. We are committed to reconciliation.
Leave a Reply