This story has been updated. Please see the most recent update below.

On August 8, 2024, the Norwegian data protection authority (Datatilsynet) published information regarding X (formerly Twitter) and its processing of user content for training artificial intelligence (AI).

Datatilsynet explained that the General Data Protection Regulation (GDPR) requires that personal data must be processed in a legal and transparent manner, that users have a right to information about how their personal data is used, and that the processing should have a valid legal basis.

According to Datatilsynet, X's use of user data to train AI is unclear, particularly regarding which data is being used and whether X has collected consent for such processing or if it relied on another legal basis. However, Datatilsynet explained that since X is established in Ireland, the Irish Data Protection Commission (DPC) is the leading supervisory authority in the matter. Datatilsynet stated that it is working closely with its European colleagues in handling the case and that it would issue an update when new information becomes available.

You can read the post, only available in Norwegian, here.

Updated: August 12, 2024

Datatilsynet issues update on X's use of personal data for AI training 

On August 9, 2024, Datatilsynet updated its post on X's processing of user content for AI training, following the DPC's statement on X's suspension of processing personal data of EU/EEA X users. Datatilsynet stated that the DPC and X have reached an agreement to stop the processing but that it does not have further details regarding the suspension. Furthermore, Datatilsynet mentioned that the investigations into X's AI model will continue and that it is following the case closely in collaboration with the DPC and other European data protection authorities.  

You can read the post, only available in Norwegian, here.

Updated: September 18, 2024 

Datatilsynet updates webpage on X's use of personal data for AI training

On September 17, 2024, Datatilsynet updated its post regarding X's use of personal data for AI training. According to Datatilsynet, X trained its AI, Grok, on user's content without informing them. Datatilsynet noted that the function to carry out this processing had been pre-ticked in user settings and that users have to opt out of the processing themselves if they do not want Grok to use their data for training. From Datatilsynet's understanding, X believes that they have introduced measures that make the training for Grok legal after August 1, 2024.

You can read the post, only available in Norwegian, here.

Updated: November 20, 2024

Datatilsynet updates webpage

On November 19, 2024, the Datatilsynet updated its webpage on X's use of personal data for training its AI models. According to Datatilsynet, X has resumed the processing of EU/EEA users' content on X to train their AI models, including its generative AI chatbot, Grok, after stopping this processing between May 7, 2024, and August 1, 2024.

You can read the webpage, only available in Norwegian, here.