Grok Bot in Europa

This section is general information. It is not legal advice.

One feature is not available yet. Tagging @bot on X to hand a post to your Bot does not work for X accounts based in the European Union or Iceland or Liechtenstein or Norway or the UK or Australia. It goes by the country X has on record for your account. So your location and any VPN make no difference (docs). No other Grok Bot feature in the docs is marked as locked to a region.

Your data leaves the EU. Grok Bot computers run in the United States. The data residency programme that covers Grok Bot is for the US only (docs). Grok Bot uses your Cursor account. Cursor’s operator says the data of EEA users may be transferred to its US servers. It says it requires an adequate level of protection for such transfers (Cursor Privacy Policy).

Regulators are watching Grok. Ireland’s Data Protection Commission opened an inquiry in April 2025. It is about whether public X posts of EU/EEA users were lawfully used to train the Grok models (DPC). It opened another inquiry in February 2026 about sexualised images made with Grok on X (DPC). Both concern X and Grok. They do not concern Grok Bot directly.

Grok Bot uses the data settings of your Cursor account. Opting out of training follows those settings (docs). Three steps:

1. Turn on Privacy Mode in your Cursor settings. Cursor says that with Privacy Mode on it will not train on your data (Cursor Security). It says its model providers have agreements for zero data retention. But flagged content may be stored for abuse investigation (Cursor Data Use). Grok Bot needs cloud storage. So the older Privacy Mode (Legacy) is not supported. You are asked to switch before you start (docs).

2. Object to training in Grok too if you use Grok on grok.com or in the Grok apps. xAI’s Europe addendum says model training relies on its legitimate interests. It says you can object in your settings to the use of your information for training (Europe addendum).

3. Keep Bots off your own computer. Go to Settings → Computer → Your computer. Set Execution on this computer to Never allow (docs).

Remember that all your Bots share one cloud computer. Sign out of services and delete sensitive files from it when a job is done (docs).

The GDPR gives you these rights:

• access (Article 15)
• erasure (Article 17)
• objection to processing based on legitimate interests (Article 21)

The company must answer within one month. For complex requests this can be extended by two further months (Article 12(3)).

Pick the right company. Grok Bot runs on your Cursor account (docs). For that data go to Cursor. Its privacy policy says to contact hi@cursor.com. You can appeal a refusal at the same address (Cursor Privacy Policy). For data in Grok on grok.com or in the Grok apps go to xAI. Its privacy policy points to its privacy portal. It names an EU representative in Dublin and a Data Protection Officer at privacy@x.ai (xAI Privacy Policy).

Write it plainly. Name the article. Say what you want: a copy of your data or deletion or an end to training on it. Give the email address of your account.

Or delete the account yourself. Deleting your Cursor account removes Grok Bot agents and chats and computers and connected apps. All data is removed within 30 days (docs). Cancel a linked SuperGrok or X Premium+ or app store subscription separately.

You can complain to a supervisory authority if you are not satisfied. You can do this in particular in your country (GDPR Article 77).

Under the Grok Bot Terms your company is responsible for permissions and approval requirements and spending limits. It must use human review before Bots send external messages or move money or delete data or make legal commitments (sections 2.2 and 2.3).

Paperwork. Grok Bot’s docs point to Cursor’s Data Processing Agreement. Data is deleted or returned within 30 days of written direction after the service ends (docs). Keep the agreement with your GDPR records.

Know the limits. Bot computers run in the US. A retention policy per organisation is not available. Action Recording (Enterprise) keeps Bot actions for 90 days (docs). Record these in your processing records.

Settings to enforce.

• Privacy Mode for the team. Then customer data is not used for training (docs). Privacy Mode (Legacy) blocks Grok Bot entirely.
• On Enterprise: required Auto Review with rules for the whole team. An example is “ask first before sending external email” (changelog v0.45.0).
• A cap on execution on the local computer for every member (docs).

Meetings. If a Bot joins calls the terms make you responsible for notices and consents from every participant (section 2.6).

Dates. The AI Act entered into force on 1 August 2024. Prohibitions applied from 2 February 2025. Rules for general purpose AI models applied from 2 August 2025. Transparency rules (Article 50) apply from 2 August 2026. After the Digital Omnibus changes the rules for high risk systems follow on 2 December 2027 and 2 August 2028 (Commission timeline).

As a private user. The Commission says that use of an AI system in a personal capacity that is not professional is outside the AI Act. Regular use for economic benefit counts as professional. Then you are a “deployer” (Commission FAQ).

As a business. Deployers must clearly label deepfakes. They must also label text generated by AI that is published to inform the public on matters of public interest. This does not apply if the text underwent human review or editorial control (quick facts). Providers of AI systems that talk directly with people must make sure people know they are dealing with AI. Chatbots and AI agents are examples of such systems. This does not apply if it is obvious (Commission FAQ).

In practice. Keep a human review step before a Bot publishes anything for the public. Does a Bot write to people outside your company? Then say in its signature that the message was drafted with AI.

The docs list only one Grok Bot feature as locked to a region. It is tagging @bot on X. It goes by the country X has on record for your account. The docs say “your current location and any VPN have no effect” (docs). A VPN does not help here.

The legal route. You don’t need tagging to work with X. Paste the post’s link into a chat with your Bot. Bots can search X and read posts and profiles. They can do this even without a connected X account (changelog v0.70.2).

What the rules say. The rule you would break with a VPN or an account registered elsewhere is in your contract with xAI. Its Acceptable Use Policy forbids “circumventing any rate limits or restrictions or protective measures and safety mitigations” (AUP). Its terms require “accurate and complete information to register for an account” (Terms). Grok Bot’s own terms make its use subject to the acceptable use policy of the provider (Grok Bot Terms section 1.1).

The risk. The terms let xAI suspend or terminate access if you violate the terms or the Acceptable Use Policy. For users in the EEA and the UK and Switzerland this needs a “reasonable and valid basis”. A terms violation is named as one (Terms: Europe Specific Terms).