Source: European Parliament
This transaction has not been formally notified to the Commission. It is up to the companies to notify transactions for merger control clearance, if they constitute a concentration with an EU dimension under the Merger Regulation[1].
The processing of personal data requires a legal basis under the General Data Protection Regulation (GDPR)[2]. The acquisition of the shares in a company that is a controller of personal data does not provide a legal basis for the processing of personal data by the acquiring company.
The transmission of personal data by X to xAI and any further processing of individuals’ personal data by xAI would therefore require a legal basis in the GDPR.
Without prejudice to the competences of the Commission as guardian of the Treaties, the enforcement of the GDPR in individual cases lies primarily with the competent national supervisory authorities and courts.
For instance, in April 2025, the Irish Data Protection Commission announced the commencement of an investigation into the processing of personal data comprised in posts on the X social media platform for the purposes of training generative artificial intelligence models, in particular the Grok Large Language Models (LLMs), developed by xAI.
In 2024, the EU adopted the Artificial Intelligence Act (AI Act)[3]. The AI Act in Article 53 sets out specific transparency requirements regarding training data for general-purpose AI (GPAI) models.
In addition, Article 55 imposes an obligation on providers of GPAI models with systemic risks to identify and mitigate those risks arising from the development and use of such models.
The AI Act’s enforcement mechanism is key to ensuring that AI models placed in the EU market are not threatening consumers’ rights and the democratic values of the EU.
- [1] Council Regulation (EC) No 139/2004 of 20 January 2004 on the control of concentrations between undertakings, OJ L 24, 29.1.2004, p. 1.
- [2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1.
- [3] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence, OJ L, 12.7.2024, 2024/1689.