Privacy Commissioner calls for order-issuing powers after X refuses recommendation to comply with privacy law

The Privacy Commissioner of Canada is calling for order-issuing powers after xAI and X Corp. refused one of his recommendations to address their privacy law violations. In January, Commissioner Philippe Dufresne expanded his ongoing investigation into X following reports xAI’s artificial intelligence chatbot, Grok, allowed users to generate millions of non-consensual sexual deepfakes on X’s social media platform (formerly Twitter). In a press conference on Thursday, Dufresne told reporters his office found the companies were in violation of Canada’s privacy framework, and suggested they immediately suspend the chatbot’s image-generation tool until proper safeguards could be implemented. But he said the companies, owned by billionaire Elon Musk, refused his recommendation, and under the current framework, the commissioner has no ability to issue orders or penalties to ensure companies respect Canada’s privacy law. Dufresne said during the investigation, the companies did introduce measures and safeguards to reduce the risk of the tool being misused to produce sexualized deepfakes. Dufresne did not go into detail on all the measures the companies implemented, however, shortly following the reports of the deepfake generation, X restricted Grok’s image-generation tool to paid users. Despite these measures, Dufresne told reporters the companies remain in violation of Canada’s privacy law, as most measures they committed to are forward looking. “They felt that they were doing enough to prevent it. They felt that the measures that they had put in place were sufficient,” he said. “We disagree on that point.” Despite the X’s refusal, Dufresne assured reporters the companies are taking the issue seriously, saying there was “good collaboration.” He said the companies committed to implement stronger monitoring, more tools to enhance user interface, and more prominent warnings. Dufresne’s office will also be provided with quarterly reports and independent third-party audits on the safeguards and evidence of their effectiveness. These reports will continue until the Commissioner is satisfied the issue of sexualized deepfakes is fully resolved. “They didn’t agree with us in terms of the pausing, but they did commit to the steps that we want them to take in terms of fixing the issue for the future,” he said. “But I want the issue to be fixed right now.” Dufresne has been calling for enforcement abilities since he was appointed privacy commissioner four years ago, and says this case is an example of why those capabilities are needed. What the commissioner can do if he does not feel his recommendations are being met, is initiate court action against the companies, but he says it is a lengthy and expensive process. “I think the lack of the possibility of fines, the possibility of orders, makes it more difficult to convince the decision makers to invest in privacy at the outset,” he said. Dufresne also continued to advocate for updated privacy laws to better scope in the digital environment, adding that it’s not enough to implement safeguards after the harm has already occurred. “We need to have more upfront compliance. We need to have these impact assessments and these mitigations and measures right at the start,” he said. “Unfortunately, this is not happening in all cases, it’s not happened in this case. So, we’re in a situation where we have to react after the fact.” “This is where having a modernized regime with proactive obligations and stronger enforcement power would lead to better outcomes for Canadians.” On Wednesday, the government tabled its long-awaited Safe Social Media Act, which includes obligations for companies to mitigate their chatbots from engaging in harmful behaviour. Dufresne said he sees opportunities to collaborate with the independent regulator that will enforce the bill to help promote privacy. “There are provisions where my office would be exchanging and consulting with that regulator, and I would expect this to be the case as we do with the CRTC with the competition bureau, so that we coordinate our efforts to maximize impacts,” he said. mcollins@thewirereport.ca

Privacy Commissioner calls for order-issuing powers after X refuses recommendation to comply with privacy law

Regulatory |
By Maria Collins
|June 11, 2026

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Privacy Commissioner calls for order-issuing powers after X refuses recommendation to comply with privacy law

Regulatory | By Maria Collins |June 11, 2026

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Miller unclear on how feds will enforce social media ban for children under 16

CRTC counsels Telus not to initiate purchase fee for SIM cards

‘As Canadian as possible under the circumstances’: CRTC official questions digital sovereignty pathway at CRRBC

Related Stories

Eastlink rolls out internet service in New Brunswick and Newfoundland and Labrador

ISED won’t raise high-speed internet standard, says 50/10 Mbps sufficient for Canadian households

FCM calls for greater cell and internet coverage in north

CRTC issues self-service regulations for internet and wireless services

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

Regulatory |
By Maria Collins
|June 11, 2026