It started in January 2026 as a series of viral, disturbing posts on X. Users discovered that Grok, the platform’s built-in AI, was granting requests to “edit” photos of real people, often by “undressing” them or placing them in transparent bikinis and revealing clothing.
Within days, what looked like a “creepy tech” problem became a massive legal crisis. The European Union and Ireland’s Data Protection Commission (DPC) launched formal probes into X, and the argument they are making changes everything for you.
The Problem: When Content Becomes a “Data Crime”
For years, social media companies treated deepfakes as a “moderation” issue, something to be deleted after it was reported. But the 2026 Grok scandal proved that reactive moderation is a failure.
According to the EU, if a chatbot can be used to generate sexualized or reputationally damaging content from your photos, this is not just a content problem; it’s a data protection issue.
Your face and voice are biometric data. Under laws like the GDPR and the 2025 AI Act, companies must have a “legal basis” (your explicit permission) to use that data. By allowing users to weaponize your photos, regulators argue that X failed to protect your digital identity at the source.
The 2026 Global Reality Check
The laws protecting your likeness now depend heavily on where you are logging in from:
| Jurisdiction | The Regulator’s Stance | What it Means for You |
| European Union | Strict Liability. | X is being probed for violating the AI Act. Fines can reach 4% of global revenue. |
| United Kingdom | Safety First. | The ICO is investigating whether “biometric consent” was bypassed during AI training. |
| United States | Harm Mitigation. | Focus is on the TAKE IT DOWN Act, requiring removal of intimate fakes within 48 hours. |
Practical Steps: How to Protect Yourself Today
You don’t have to wait for a court ruling to reclaim your privacy. Here are the three most effective moves you can make right now:
1. The “Opt-Out” Audit
Most platforms silently enroll you in AI training. You need to manually pull your data out of the “training bin.”
- On X: Go to Settings > Privacy and Safety > Grok. Uncheck the box that allows them to use your posts and interactions for training.
- On Meta (Instagram/Facebook): Look for “AI Virtual Assets” or “Generative AI” in your privacy center and object to the processing of your images.
2. Use the “Legal Magic Words”
If you find an AI-generated version of yourself, don’t just click “report for bullying.” Send a formal request to the platform’s Privacy Officer.
The Script: “I am exercising my Right to Erasure regarding my biometric personal data. This AI-generated content uses my likeness without a valid legal basis. Remove it immediately and confirm my data has been purged from your training set.”
3. “Poison” Your Public Photos
If you are a creator or have a public profile, use “data poisoning” tools like Glaze or Nightshade. These add a microscopic digital layer to your photos that is invisible to humans but “breaks” the AI’s ability to map your face correctly. It makes your photos useless to scrapers.