Part of the AI Regulation News hub.
Turkey's data protection board opens an own-motion investigation into X Internet Unlimited Company and X.AI Corporation over Grok, under Personal Data Protection Law No. 6698
Turkey is the fourth authority we have covered acting on Grok, after Ireland's DPC, Brazil's ANPD and a Dutch court. This is backfill, not breaking news: the announcement is dated 11 February 2026 and we had not covered it. The KVKK's stated grounds are narrower than a content case: it suspects the required technical and administrative measures were not taken, and that personal data were processed unlawfully.
Bottom line: An enforcement step, not guidance and not a fine. The Board decided to open a re'sen inceleme, an own-motion examination. The announcement states no decision number, no fine, no corrective order and no procedural timetable.
Who this affects: X Internet Unlimited Company and X.AI Corporation as the named subjects. More broadly, any AI platform operator or controller processing the personal data of users in Turkey, and the data-protection and compliance functions behind them.
Date of legal event: 11 February 2026. The announcement page carries Yayinlanma Tarihi: 11 Subat 2026, Carsamba in its own header metadata.
The legal hook: Law No. 6698 on the Protection of Personal Data. The Board's stated suspicion is that the necessary technical and administrative measures were not taken in developing and deploying Grok, and that personal data were processed contrary to the Law.
What it is not: This is not a Turkish content-blocking order and not a finding of breach. It is a decision to examine. The outcome and the precise provisions the Board will apply are not stated in the notice.
Primary sources: KVKK, GROK Yapay Zeka Asistani Hakkinda Kamuoyu Duyurusu, 11 February 2026
- Instrument
- Kamuoyu duyurusu (public announcement), GROK Yapay Zeka Asistani Hakkinda Kamuoyu Duyurusu. No decision number is given in the notice
- Authority
- Kisisel Verileri Koruma Kurulu, the Personal Data Protection Board (KVKK), Turkiye
- Jurisdiction
- Turkiye
- Date of legal event
- 11 February 2026, read from the page's own Yayinlanma Tarihi header. NOTE: the sidebar of this page lists a DIFFERENT announcement dated 27 Agustos 2026; that date does not belong to this notice
- Status
- Investigation opened. No decision, no fine, no corrective order announced
- Bindingness
- The announcement itself imposes no new obligation. It records an enforcement step under existing law
- Named subjects
- X Internet Unlimited Company and X.AI Corporation
- Legal basis
- Law No. 6698 on the Protection of Personal Data (6698 sayili Kisisel Verilerin Korunmasi Kanunu)
- Stated grounds
- Suspicion that the necessary technical and administrative measures were not taken in the development and deployment of Grok, and that personal data were processed contrary to the Law
- Procedure
- Re'sen inceleme, an own-motion examination opened by decision of the Board
- Unresolved
- No decision file, no case number, no timetable and no stated sanction. The announcement is a single operative paragraph
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://www.kvkk.gov.tr/Icerik/8614/grok-yapay-zeka-asistani-hakkinda-kamuoyu-duyurusu
What the KVKK actually announced
The operative sentence is one line. The Board announced that, given the suspicion that the necessary technical and administrative measures were not taken within the scope of Law No. 6698 during the development and deployment of Grok, and that personal data were processed contrary to the Law, it has decided to open an own-motion examination of X Internet Unlimited Company and X.AI Corporation.
The Turkish term is re'sen inceleme. It is the Board acting on its own initiative rather than on a complaint. Opening one is a procedural step: it establishes that the authority is looking, not that it has found anything.
The notice also records, as background, that the European Commission had opened proceedings on grounds concerning the generation and circulation of sexualised imagery. The KVKK's own stated grounds are narrower than that and sit squarely in data protection: measures and lawfulness of processing.
Read the two apart. A reader who conflates the background reference with the Turkish grounds will describe this as a content case, and it is not one on the face of the announcement.
Turkey is the fourth authority in this pattern
This is not an isolated national action, and the pattern is now dense enough to plan around. Ireland's Data Protection Commission opened an inquiry into X and Grok over sexualised images. Brazil's ANPD issued a technical note on Grok and deepfakes under the LGPD. A Dutch court addressed Grok's nudify capability and CSAM. Turkey's KVKK now joins them.
Four authorities, four legal instruments, four procedural postures. For a controller the practical consequence is that a single model deployment is being examined simultaneously under Irish and EU data-protection procedure, Brazilian LGPD supervision, Dutch judicial process and now Turkish Law No. 6698.
The common thread is not a content rule. In Turkey, and to a large degree in the Irish and Brazilian actions, the hook is the adequacy of technical and organisational measures and the lawfulness of processing, which are ordinary data-protection duties that predate any AI-specific statute.
What the announcement does not tell you
There is no decision number, so this cannot yet be tracked as a numbered file. There is no stated timetable, no interim measure, no fine and no corrective order.
The notice also does not identify which provisions of Law No. 6698 the Board will apply. It refers to technical and administrative measures and to unlawful processing, which points at the security obligations and the lawfulness conditions, but the Board has not committed itself.
That matters for anyone briefing a client. The defensible statement today is that an own-motion examination has been opened and what its stated grounds are. Anything about likely outcome or exposure is inference, and the source does not support it.
Record this as an enforcement step, not an outcome. The KVKK opened an own-motion examination of X Internet Unlimited Company and X.AI Corporation, announced 11 February 2026, on the stated suspicion that the technical and administrative measures required by Law No. 6698 were not taken in developing and deploying Grok and that personal data were processed unlawfully. No decision number, fine, order or timetable is announced. The wider point for compliance teams is the convergence: this is the fourth authority we have covered examining the same model, and in each case the operative duties are ordinary data-protection obligations rather than AI-specific ones.
Source File
https://www.kvkk.gov.tr/Icerik/8614/grok-yapay-zeka-asistani-hakkinda-kamuoyu-duyurusu
Open the KVKK announcement and confirm the page header carries Yayinlanma Tarihi: 11 Subat 2026, Carsamba, and the phrase re'sen inceleme. Be careful with dates on this page: the right-hand sidebar lists other announcements with their own dates, including one dated 27 Agustos 2026 for a separate biometric principle decision. Read the date from the news__detail-head-meta block, not from the sidebar. Confirm both named entities, X Internet Unlimited Company and X.AI Corporation, and the reference to 6698 sayili Kisisel Verilerin Korunmasi Kanunu. Note that no decision number appears anywhere in the notice. A same-host control, the KVKK home page, should also return HTTP 200 so that a failed fetch is not mistaken for an absent page.
X Internet Unlimited Company ve X.AI Corporation hakkında Kişisel Verileri Koruma Kurulu tarafından re'sen inceleme başlatılmasına karar verilmiştir. - KVKK public announcement, 11 February 2026 (original Turkish; the source's typographic apostrophe in re'sen is normalised to TLY house style) (translated: it has been decided by the Personal Data Protection Board to initiate an ex officio examination concerning X Internet Unlimited Company and X.AI Corporation)
FAQ
When was this announced?
11 February 2026. The page header carries Yayinlanma Tarihi: 11 Subat 2026, Carsamba. A 27 Agustos 2026 date appears elsewhere on the same page but belongs to a different announcement listed in the sidebar.
Has Turkey fined X or X.AI over Grok?
No. The announcement records only that the Board decided to open an own-motion examination. It states no fine, no corrective order and no decision number.
What law is the investigation under?
Law No. 6698 on the Protection of Personal Data. The stated suspicion is that the necessary technical and administrative measures were not taken in developing and deploying Grok, and that personal data were processed contrary to the Law.
Is this a content-blocking action?
Not on the face of the announcement. The notice mentions European Commission proceedings concerning sexualised imagery as background, but the KVKK's own stated grounds are data-protection grounds: measures and lawfulness of processing.
What is a re'sen inceleme?
An own-motion examination, opened by the Board on its own initiative rather than in response to a complaint. It is a procedural step indicating that the authority is examining the matter, not a finding.
How does this relate to the other Grok actions?
It is a separate proceeding by a separate authority under a separate national law. Ireland's DPC, Brazil's ANPD and a Dutch court have each acted on Grok on their own bases; the Turkish examination adds a fourth forum, not a continuation of any of them.
When will there be an outcome?
The announcement gives no timetable. Because it carries no decision number, there is currently no numbered file to track.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.