What happened
After reports that Grok had generated millions of sexualized deepfakes of real people, the Office of the Privacy Commissioner (OPC) opened an investigation in January 2026. Its June report found X Corp. and xAI violated PIPEDA: they had no valid consent and launched the tool without appropriate safeguards. The companies disagreed with the findings but committed to quarterly reports and independent audits; the OPC lists the matter as well-founded and not yet resolved. (Office of the Privacy Commissioner of Canada, June 11, 2026)
What it means for Canada
Canada's privacy regulator found a major AI image tool broke PIPEDA by launching without safeguards. It is the clearest statement yet of what the OPC expects from any company shipping generative AI that touches personal information.
- Sectors
- AI developers · Social media and platforms · Any company adding generative AI features
- Tools involved
- Grok / Grok Imagine · Image-generation tools
- Canadian rules
- PIPEDA consent and appropriate-purpose rules (s. 5(3))
Pending federal privacy reform (orders and fines)
Takeaways for Canadian businesses and individuals
- BusinessDo a privacy impact assessment before launching AI features that process faces, voices or other personal information; the OPC faulted the lack of up-front assessment.
- BusinessTest misuse safeguards before launch and keep evidence they work; the OPC would not close the case without proof of effectiveness.
- BusinessPlan for federal privacy reform that the OPC says should add order-making powers and fines.
- IndividualsVictims of non-consensual deepfakes can file a complaint with the OPC.
For the Canadian AI sector
For Canadian AI builders this is the clearest signal yet of what regulators expect: safeguards and privacy impact assessments before release, not after harm appears.
Written by AgentsNorth from the source below. General information, not legal or security advice.