In Brazil, the National Data Protection Authority (ANPD) and the National Consumer Secretariat (Senacon) ordered X on February 11, 2026, to immediately implement safeguards to stop Grok from generating inappropriate sexualized content. The Federal Public Prosecutor's Office (MPF) required monthly reports on the platform's response. The orders followed a joint recommendation issued on January 20. They do not, by themselves, establish that the flaws have been fixed or that a penalty has already been imposed.
The case concerns reports of generative artificial intelligence being used to create deepfakes, synthetic images, videos or audio that depict real people in situations that did not occur. The central concern here is sexualized depictions of children and adolescents, as well as identifiable adults without their authorization. The three Brazilian bodies coordinated their response while acting under their separate legal powers and procedures.
January 20: what did the joint recommendation ask for?
ANPD, MPF and Senacon issued recommendations to the company controlling the X platform following allegations and assessments described by the authorities. At that stage, the document was a recommendation, coupled with a warning that administrative or judicial measures could follow if the response proved inadequate.
- Prevent new outputs: immediately introduce barriers stopping Grok from producing images, videos or audio sexualizing children and adolescents, or identifiable adults without permission, across all versions, plans and modes.
- Address existing content: within 30 days, establish procedures for identifying, reviewing and removing such material previously generated by Grok and still available on X.
- Act against accounts: immediately suspend accounts involved in such activity and provide monthly reports demonstrating the measures taken.
- Help affected individuals: provide an accessible, effective route for complaints and the exercise of personal-data rights, with appropriate responses.
- Assess data processing: prepare a data protection impact assessment covering Grok's manipulation of photographs, video and audio through which individuals can be identified.
The 30-day period concerned setting up procedures to identify, review and remove previously posted material. It was not permission to keep generating inappropriate new images during that period.
February 11: what did each authority order?
After receiving X's response, the authorities said the information submitted was inadequate. According to their official announcement, preliminary tests by their technical teams suggested that failures persisted. The subsequent measures differed in legal character:
| Authority | February measure | Required evidence |
|---|---|---|
| ANPD | Preventive measure requiring immediate improvement and implementation of technical and organizational safeguards against inappropriate Grok outputs. | Within five business days, detail the actions and submit verifiable documentary evidence of their effectiveness, covering versions, plans and modes. |
| MPF | Order for monthly reports, beginning in February, on efforts to counter the production and circulation of deepfakes covered by the case. | Provide figures for harmful posts removed and accounts suspended in each reporting period, along with case-specific evidence allowing the response to be assessed. |
| Senacon | Administrative precautionary measure requiring immediate solutions to prevent Grok from generating or enabling inappropriate images, videos and audio in the consumer market. | List measures taken and submit verifiable quantitative reporting on detection, moderation, removal, average response times and any restrictions imposed. |
ANPD acted under its data protection oversight powers, citing articles 32(III) and 35 of its Inspection Regulation. Senacon invoked safety and harm-prevention duties under Brazil's Consumer Protection Code. MPF is conducting a separate investigation into the facts. This division of responsibilities explains why the case is neither a single court ruling nor a blanket ban on using Grok for any purpose.
What did X claim to have done, and why did the authorities disagree?
In its reply to the initial recommendation, X said it had removed thousands of posts, suspended hundreds of accounts and introduced safety measures. The February 11 official release records those claims, but also the authorities' assessment that technical reports, verifiable documentation and monitoring mechanisms were missing, making it impossible to evaluate how effective the actions were in the Grok incident.
Three points must therefore remain separate: X reported actions; the authorities found the supporting evidence inadequate; and their preliminary checks suggested that problems continued. A claimed removal count alone cannot demonstrate effective prevention of new outputs, while the release does not establish an independent test of every channel through which the service is available.
X's challenge reported on February 13
In a February 13 report, Reuters said X had asked ANPD to start counting the five-day deadline only after the authorities provided further details about their tests. The company challenged the identification of the Grok mode used, the prompts submitted and the results recorded.
X also stated that a third-party domain, grokimagine.ai, mentioned in early documents was neither owned nor operated by the company. According to Reuters, X asked for the measures to be suspended if it was established that tests underpinning them had been carried out on that service. Reuters investigated the website and could not confirm that it was genuinely integrated with Grok.
That challenge is X's stated position, not a ruling accepting its defense or proof that all official checks were invalid. It also does not justify automatically attributing content found on websites using the Grok name to the actual product. Distinguishing X's product, its other official channels and third-party pages is essential when assessing technical responsibility.
What deadlines and potential penalties were involved?
The different steps had different requirements and time frames. The January 20 recommendation allowed up to 30 days for procedures addressing existing content, while calling for immediate prevention and monthly reports. On February 11, ANPD set a five-business-day deadline for evidence of compliance with its preventive measure; Senacon ordered immediate action and monitoring data; and MPF ordered monthly reporting.
ANPD warned that further orders, daily fines and potential administrative sanction proceedings could follow. Senacon raised the prospect of administrative proceedings and sanctions under article 56 of Brazil's Consumer Protection Code. MPF pointed to legal consequences if required reports were not submitted, including possible court action. These were conditional consequences described in the announcement, not fines or judgments automatically imposed on that date.
How can a promised fix be distinguished from verified compliance?
Meaningful verification would require evidence about at least four areas: preventing inappropriate new outputs, identifying and removing existing material, responding to complaints, and the reach of safeguards across the relevant versions and modes. Statistics on content removal or account suspensions need a defined reporting period, technical criteria and a means of verification. This distinction between announcing an action and demonstrating its effectiveness runs through the official documents.
Information status as of October 24, 2026: the sources reviewed document the January recommendation, the February orders and X's subsequent challenge. They do not establish a publicly verifiable conclusion that every requirement has been fully met. That does not mean no improvements were made afterward, that noncompliance has been definitively established or that a penalty has already been applied. This reporting also involved no firsthand operation of Grok, no audit of X's systems and no comprehensive, up-to-date review of the administrative case files.
