Privacy Group Files GDPR Complaints Over X AI Data Plans

Vienna-based privacy group Noyb (None Of Your Business) has filed complaints against X, formerly Twitter, in nine European countries over its use of Europeans’ data to train artificial intelligence (AI) tools.

The group said Ireland’s data protection regulator, where X and many other large tech companies have their EU headquarters, was taking an approach that was too “pro-corporate” and that getting other EU data protection regulators involved would focus more attention on the situation.

The group said its complaints were filed in Austria, Belgium, France, Greece, Ireland, Italy, Netherlands, Spain and Poland.

In May X began providing posts by its EU users to xAI, a start-up launched last year by X owner Elon Musk, to train tools such as chatbot Grok, Noyb said.

Informed consent

X last September updated its terms of service to indicate users’ data would be used for such purposes.

A pitch to investors disclosed in May also argued xAI would have advantages over rivals through its connections to other Musk companies, including user data from X for use in training its large language model (LLM).

But X never informed its users their data would be used to train AI models, with most people finding out about the situation via a widely viewed post by an X user in late July.

These acts violate the EU’s GDPR data regulations, which require companies to obtain users’ informed consent to make use of their data, Noyb argued.

The Irish Data Protection Commission (DPC) last week obtained an agreement from X to temporarily stop processing EU data for AI purposes until they have been given the option to withdraw their consent, an Irish court hearing was told last week.

Compliance

But Noyb said the DPC’s complaint was mainly concerned with mitigation measures and a lack of cooperation by X, while failing to question the legality of the data processing itself.

“We want to ensure that Twitter fully complies with EU law, which – at a bare minimum – requires to ask users for consent in this case,” said Noyb chairman Max Schrems.

The hearing found X had only given users the option to object several weeks after the start of data collection.

X’s global government affairs account said on Friday, following the hearing, that the company would continue to work with the DPC on AI issues.

In July Facebook parent Meta said it would not be launching its AI assistant in the EU for the time being after the DPC told it to rework its plans.

Noyb had earlier filed complaints in several countries after Meta informed users of its AI data processing plans but did not ask for their consent.