X.AI LLC – Court Ruling (Netherlands, 2026)

X is a social media platform. X.AI LLC (a US company) is the provider of the generative AI chatbot Grok. X Internet Unlimited Company (XIUC) is the Irish entity that operates the platform in the European Economic Area and the UK (outside of these regions it is provided by X Corp, a US corporation). For GDPR purposes, XIUC is the controller in this case. One of the tasks that Grok does is generating visual content, where users can request the LLM to generate and/or edit images. Stichting Offlimits (a non profit organisation) estimated that Grok had generated approximately 3 million sexualised images between December 29 2025 and January 9 2026, of which approximately 23,000 depicted children. The controller later restricted the feature to paid members, and announced measures to prevent the Grok account on X from editing images of real people. In January 2026 the EU Commission announced that it was launching an investigation on whether the controller met its obligations under the Digital Services Act (DSA) relating to the dissemination of illegal content in the EU. In February 2026 Stichting Offlimits filed preliminary injunction before the court, requesting that the court prohibit the controller from generating and/or distributing sexual imagery through the image generating functionality. This was the case for non consensual imagery and imagery classified as child pornography under national law. In addition, the organisation requested the court to prohibit the controller from offering Grok’s functionality as part of its platform as long as it allows users to generate these images. The organisation brought claims based on tort and violations of the GDPR; specifically it argued that creating and distributing non consensual nude images was unlawful processing of personal data under the GDPR. The controller argued that it was impossible to generate these images, and that it implemented technical safeguards to prevent users from circumventing the restrictions on generating images. Finally, the controller argued that it was the user who generated the images, and that Grok was a tool. The court first clarified that it was competent to hear the case. Under the GDPR, XIUC is the controller for the processing of personal data of data subjects in the Netherlands. Article 79(2) GDPR allows for proceedings to (also) be brought where the data subject (or the organisation) habitually resides. The court also had jurisdiction based on [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32012R1215 Article 7(2) of the Brussels I-bis Regulation], since the alleged damage from the controller’s alleged tortious conduct happened in the Netherlands. The court stated that it was competent within courts in the Netherlands, as it was sufficiently plausible that the alleged harm also took place in Amsterdam. Finally, the court joined the claims brought by the organisation against XIUC and the US entity X.AI LLC and X CORP, based on considerations of efficiency under national procedural law. In terms of substance, the court first stated that it was undisputed that the controller processed personal data in its image generating feature. The court then stated that the organisation had provided sufficient evidence in demonstrating that the feature violated data subjects’ GDPR and privacy rights; in its submissions, the organisation showed that Grok generated images of data subjects without verifying whether consent had been obtained. The court considered that the controller had not implemented sufficient safeguards, and questioned the effectiveness of the measures it had implemented. The legal status of the evidence of child sexual abuse material (CSAM) on the platform was, in the court’s view, more complicated to determine. The court stated that the specific image submitted by the organisation did not show explicit nudity, and it was not evident that the person was a minor since the image depicted a fictional character. Nonetheless, the court concluded that it was not necessary to determine the legal status of the image, as the organisation sufficiently demonstrated that Grok users can push boundaries when generating images. This means that whether CSAM is involved depends on the context, and that the controller had similarly not implemented sufficient measures to prevent this. The court granted the preliminary injunction claims, as the non consensual images violated the GDPR, and the (facilitation of) generating CSAM violated the national Civil Code. The court found that it was sufficiently plausible that the controller unlawfully and culpably contributes to a climate of online inappropriate behaviour, and that the organisation has sufficient urgent interest. The court dismissed the controller’s arguments in relation to the user being responsible, as the controller was the intermediary that controlled the functionalities of Grok. Therefore, the court prohibited both XIUC and X.AI from generating and/or distributing sexual imagery without explicit consent of the individuals involved residing in the Netherlands through its Grok function. This was also the case for producing, distributing, offering and publicly displaying CSAM. The US entity X.AI was included, on the grounds that harm could still occur in the Netherlands even if X facilitates the distribution of images of Dutch nationals outside of the Netherlands. The court acknowledged that it did not have international jurisdiction to rule on the legality of distributing generated images of fictional persons outside of the Netherlands. Therefore, the injunction against X.AI was limited to unlawful images of persons residing in the Netherlands. This limitation, however, did not apply to XIUC.