Italy’s privacy watchdog takes aim at Grok and AI deepfakes

According to Reuters, on Thursday, January 8, Italy’s data protection authority issued a formal warning to users and providers of AI tools, explicitly naming Elon Musk’s chatbot Grok. The watchdog highlighted the severe risk of these platforms generating deepfake images from real content without an individual’s consent. The action comes amid growing EU scrutiny over AI that enables non-consensual, sexualized imagery. The Italian regulator is now working directly with Ireland’s Data Protection Commission, which leads on privacy matters for X, and has reserved the right to take further legal steps. It stated that services allowing the creation of content like digitally “undressing” people could be criminal offenses under EU law. Finally, it urged all providers to implement stronger safeguards to prevent this kind of misuse.

The EU’s enforcement muscle is flexing

This isn’t just a sternly worded letter. Here’s the thing: by teaming up with Ireland’s DPC, the Italian watchdog is signaling it’s serious about enforcement for a major platform. X, and by extension Grok, has its main EU establishment in Ireland, making the Irish authority the lead supervisor under the GDPR. So this collaboration is a big deal—it shows a coordinated front. They’re basically putting the industry on notice that the existing rules, like the GDPR and the Digital Services Act, have teeth that can bite when it comes to AI-generated abuse. The reference to potential “criminal offences” is a major escalation in rhetoric, moving the conversation from terms-of-service violations to actual lawbreaking.

Why this is such a gnarly technical problem

But can you really “safeguard” your way out of this? The core challenge is that the very capability that makes these generative AI models powerful—their ability to remix and reimagine concepts from training data—is the same feature that enables deepfakes. You can try to filter prompts or outputs, but users constantly find workarounds. The models are probabilistic, not deterministic. So, building a reliable filter that blocks all harmful content without also crippling legitimate uses is a massive, maybe even impossible, technical trade-off. Do you slow down innovation to try and catch every bad actor? Or does the onshift need to be on a different part of the ecosystem, like the platforms that host and distribute this content?

A warning shot for the entire industry

Look, singling out Grok makes for a great headline, but this warning is clearly meant for every AI provider out there. Italy’s move is a canary in the coal mine for how European regulators plan to handle the generative AI wave. They’re not waiting for the comprehensive AI Act to be fully enforced; they’re using the legal tools they already have. I think we’re going to see more of this. The question is whether it leads to a patchwork of national actions or a more unified EU strategy. For companies, the message is clear: if your tool can be misused to violate privacy and dignity, you’d better have a convincing story about your mitigation efforts—and soon.