Grok’s AI Image Generator Violates Privacy Law: How to Protect Your Photos

Canada’s privacy regulator has ruled that Grok’s AI image generator broke the law by scraping photos from the web without people’s consent. The decision is one of the first major enforcement actions against a popular AI tool and has implications for anyone who posts images online. Here’s what happened, why it matters, and what you can do to keep your pictures from being used without your permission.

What happened

The Canadian Privacy Commissioner found that Grok’s image generator violated the country’s Personal Information Protection and Electronic Documents Act (PIPEDA). According to the ruling, the tool collected images from publicly accessible websites and used them to train its model without obtaining proper consent from the people in those photos. The regulator also noted that the company did not provide a meaningful way for individuals to opt out before their images were scraped.

The finding, reported by MLex and other outlets, follows earlier complaints about Grok generating “undressing” images of women without their knowledge — a practice that had already drawn scrutiny from regulators in Europe and elsewhere. The Canadian decision is notable because it explicitly states that scraping images from public websites for AI training is not automatically lawful, even if the images are already visible online.

Why it matters

This ruling is not just about one company. Any AI image generator that trains on public web images — including models from major tech firms — may face similar legal risks if they fail to get consent. The Canadian decision could set a precedent for other countries, especially as regulators worldwide are wrestling with how to apply existing privacy laws to artificial intelligence.

For everyday users, the immediate concern is that your photos — vacation shots, profile pictures, family portraits — could end up in an AI training dataset without your knowledge. Once an image is used to train a model, it can be recombined into new images (deepfakes) that look like you, often without any way for you to control or remove them. The risk of unauthorized deepfakes is not hypothetical; it has already caused real harm, from harassment to identity fraud.

The ruling also underscores a broader point: “public” does not mean “free for any use.” Just because you post a picture on a social media platform or a personal blog does not give companies the right to use it to train commercial AI products.

What readers can do

While you cannot single-handedly stop every company from scraping your images, you can reduce your exposure and take action if you suspect misuse.

  • Review your social media privacy settings. Many platforms allow you to limit who can view your photos. Set your accounts to “friends only” or “private” where possible. Public posts are much easier for scrapers to collect.
  • Use opt-out tools where available. Some AI companies — including OpenAI, Google, and Meta — offer forms to request that your data be excluded from future training. Grok’s parent company (X) may now be required to provide such an option in Canada; check for similar mechanisms for other tools you use.
  • Add visible watermarks or metadata. While not foolproof, a clear watermark can deter casual scraping and make it harder for others to claim your image as their own. Some services let you embed copyright metadata in image files.
  • Monitor for deepfakes. There are free and paid tools that scan the web for matches of your face in generated images. Services like PimEyes (for facial recognition) or Sensity (for deepfake detection) can alert you if your likeness appears unexpectedly. Note that these tools have their own privacy implications, so read their policies before uploading your photos.
  • Report misuse. If you find that your image has been used without consent in an AI generator, contact the company directly and file a complaint with your country’s privacy authority (in Canada, the Office of the Privacy Commissioner; in the US, the FTC; in the EU, your national data protection authority). The Canadian ruling shows that regulators are willing to act.

Sources

  • MLex, “Grok’s AI image generator violated privacy law, Canada’s Privacy Commissioner finds” (June 11, 2026)
  • Tech Policy Press, “Tracking Regulator Responses to the Grok ‘Undressing’ Controversy” (January 6, 2026)
  • Office of the Privacy Commissioner of Canada, PIPEDA findings (official summary pending publication)

This article is for informational purposes and does not constitute legal advice. Privacy laws vary by jurisdiction.