xAI (Grok)

In August 2025, Forbes found more than 370,000 private Grok conversations sitting in Google's search index - medical and psychological questions, business details, uploaded files, and at least one password. The cause was the share button: on Grok it published the conversation to a public URL with no warning and no disclaimer, where OpenAI's version at least carried one. Users had been flagging the problem since January; xAI did not respond to press inquiries, and Musk's public reaction was to post 'Grok FTW' promoting Grok as the alternative to ChatGPT, whose similar feature had already been pulled. Then in May 2026 a proposed class action alleged that Grok.com's embedded tracking code was routing entire conversations - finance, health, legal - to Google, Meta and TikTok for ad targeting, allegedly even for users who had opted out of cookies, seeking $5,000 per violation.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Y - xAI consumer terms include arbitration and class waiver provisions (verify opt-out mechanics against the live terms). PRIVATE LITIGATION: Skaggs v. X.AI Corp., filed May 14 2026, N.D. Cal. - proposed class action alleging violations of the Electronic Communications Privacy Act, California Invasion of Privacy Act, and the California Constitution. Seeks $5,000 per state-law violation plus federal damages. Proposed class: all US residents who entered queries on Grok.com. Allegations only; not adjudicated as of this pass.

Data sharing

ALLEGED (class action, not adjudicated): embedded third-party tracking code on Grok.com transmits full conversation content, unique per-conversation URLs, page titles and metadata to Google, Meta and TikTok for ad targeting - reportedly including for users who declined cookies. CONFIRMED: the share feature published conversations to publicly crawlable URLs with no disclaimer, unlike OpenAI's equivalent which carried a warning.

Contacts

Privacy contact. Not verified this pass — recommend a direct follow-up

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. X.AI LLC — mailing address not published in the consumer privacy policy reviewed this pass; note xAI states it is a separate company from X Corp.