A UK Grok Lawsuit Exposes Canada’s Privacy Gap
Matthew Leo · Published July 28, 2026 · Canada Tech
A British court may soon be asked to do what Canada’s privacy regulator could not do directly: order xAI to make Grok stop producing non-consensual sexualized images.
British Labour MP Jess Asato is suing xAI in the United Kingdom after manipulated sexualized images depicting her were generated through Grok. Her lawsuit seeks a High Court order requiring effective technical measures to prevent the system from producing such images of her.
The court has not granted that order. xAI had not filed its response when Reuters published its report on July 28, 2026, and the allegations remain to be tested.
Canada has already investigated substantially similar conduct. The uncomfortable difference is what happened after the investigation.
Canada found violations but could not issue an order
On June 11, the Office of the Privacy Commissioner of Canada published its findings concerning X and xAI.
The regulator concluded that the companies contravened Canada’s private-sector privacy law by producing sexualized deepfakes without valid consent and for purposes a reasonable person would not consider appropriate.
It recommended that Grok Imagine be suspended until X and xAI could demonstrate that their safeguards were sufficient. It also called for independent annual audits, proactive monitoring and a formal process for identifying privacy risks before launching new image-generation products.
X and xAI disagreed with the conclusions. They said non-consensual intimate imagery and child sexual abuse material had no place on their services, described additional safeguards and rejected the recommendation to suspend Grok Imagine.
The commissioner ultimately classified the complaint as well-founded and unresolved.
The enforcement difference matters
Under the current Personal Information Protection and Electronic Documents Act, Canada’s privacy commissioner cannot independently issue a binding compliance order or administrative financial penalty.
The commissioner or a complainant can pursue enforcement through Federal Court in qualifying circumstances. That route, however, adds another legal stage after the investigation.
As Mapletechie explained in our coverage of Canada’s privacy finding against OpenAI, the regulator can investigate, publish findings and apply public pressure. It cannot simply order a global technology company to change its product that afternoon.
| Action | United Kingdom case | Canadian investigation |
|---|---|---|
| Current stage | Civil lawsuit before the High Court | Completed privacy investigation |
| Requested result | Binding order requiring technical safeguards | Recommendation to suspend Grok Imagine |
| Final result | Not yet decided | Well-founded and unresolved |
The safeguards have not been proved effective
X told the Canadian regulator it had improved its systems for detecting requests to remove or alter clothing, strengthened monitoring and restricted some image generation by unpaid users.
Those are relevant changes. They are not the same as demonstrating that the problem has been solved.
The commissioner said the companies had not provided evidence showing that the new safeguards fully prevented or mitigated the behaviour. X also reported removing 126 Canadian posts it identified as child sexual abuse material or non-consensual intimate imagery by March 6. xAI said it could not provide a comparable breakdown for its standalone Grok service.
Reuters separately reported that Grok continued producing sexualized images during testing in February, after restrictions had been announced.
Canada needs remedies that move at software speed
This is not an argument that every allegation should trigger an immediate government shutdown of an AI product. Binding orders need evidence, procedural fairness and a path to appeal.
It is an argument that a regulator should have meaningful options once a careful investigation identifies serious, ongoing harm.
An image generator can be updated globally in hours. A system that requires a regulator to investigate, recommend, wait for voluntary cooperation and potentially begin a second court process operates on a completely different clock.
That gap is especially difficult to defend when the product can target real people who never agreed to participate.
The British lawsuit may fail, settle or produce a narrower remedy than Asato wants. It nevertheless places the core issue before a court capable of making a binding decision.
Canada has already established its factual position. What it still lacks is an enforcement system capable of turning that position into a timely technical requirement.