Grok Bot in Europe

This section is general information, not legal advice.

One feature is not available yet. Tagging @bot on X to hand a post to your Bot does not work for X accounts based in the European Union, Iceland, Liechtenstein, Norway, the UK or Australia. It goes by the country X has on record for your account, so your location and any VPN make no difference (docs). No other Grok Bot feature in the docs is marked as region-locked.

Your data leaves the EU. Grok Bot computers run in the United States, and the data residency programme that covers Grok Bot is US-only (docs). Grok Bot uses your Cursor account; Cursor’s operator says EEA users’ data may be transferred to its US servers and that it requires an adequate level of protection for such transfers (Cursor Privacy Policy).

Regulators are watching Grok. Ireland’s Data Protection Commission opened an inquiry in April 2025 into whether EU/EEA users’ public X posts were lawfully used to train the Grok models (DPC), and another in February 2026 about sexualised images made with Grok on X (DPC). Both concern X and Grok, not Grok Bot directly.

Grok Bot uses your Cursor account’s data settings, and training opt-out follows those settings (docs). Three steps:

1. Turn on Privacy Mode in your Cursor settings. Cursor says that with Privacy Mode on, it will not train on your data (Cursor Security), and that its model providers have zero-data-retention agreements, though flagged content may be stored for abuse investigation (Cursor Data Use). Grok Bot needs cloud storage, so the older Privacy Mode (Legacy) is not supported; you are asked to switch before you start (docs).

2. If you also use Grok (grok.com or the Grok apps), object to training there. xAI’s Europe addendum says model training relies on its legitimate interests, and that you can object to the use of your information for training in your settings (Europe addendum).

3. Keep Bots off your own computer. In Settings → Computer → Your computer, set Execution on this computer to Never allow (docs).

Remember that all your Bots share one cloud computer. Sign out of services and delete sensitive files from it when a job is done (docs).

The GDPR gives you the right of access (Article 15), erasure (Article 17) and objection to processing based on legitimate interests (Article 21). The company must answer within one month, extendable by two further months for complex requests (Article 12(3)).

Pick the right company. Grok Bot runs on your Cursor account (docs). For that data, Cursor’s privacy policy says to contact hi@cursor.com; you can appeal a refusal at the same address (Cursor Privacy Policy). For data in Grok on grok.com or the Grok apps, xAI’s privacy policy points to its privacy portal, names an EU representative in Dublin and a Data Protection Officer at privacy@x.ai (xAI Privacy Policy).

Write it plainly. Name the article, say what you want (a copy of your data, deletion, or an end to training on it) and give the email address of your account.

Or delete the account yourself. Deleting your Cursor account removes Grok Bot agents, chats, computers and connected apps, with all data removed within 30 days (docs). Cancel a linked SuperGrok, X Premium+ or app-store subscription separately.

If you are not satisfied, you can complain to a supervisory authority, in particular in your country (GDPR Article 77).

Under the Grok Bot Terms, your company is responsible for permissions, approval requirements and spending limits, and must use human review before Bots send external messages, move money, delete data or make legal commitments (sections 2.2 and 2.3).

Paperwork. Grok Bot’s docs point to Cursor’s Data Processing Agreement: data is deleted or returned within 30 days of written direction after the service ends (docs). Keep it with your GDPR records.

Know the limits. Bot computers run in the US. A per-organisation retention policy is not available. Action Recording (Enterprise) keeps Bot actions for 90 days (docs). Record these in your processing records.

Settings to enforce.

• Privacy Mode for the team: then customer data is not used for training (docs). Privacy Mode (Legacy) blocks Grok Bot entirely.
• On Enterprise, required Auto-review with team-wide rules, such as “ask first before sending external email” (changelog, v0.45.0).
• A cap on local-computer execution for every member (docs).

Meetings. If a Bot joins calls, the terms make you responsible for notices and consents from every participant (section 2.6).

Dates. The AI Act entered into force on 1 August 2024. Prohibitions applied from 2 February 2025 and rules for general-purpose AI models from 2 August 2025. Transparency rules (Article 50) apply from 2 August 2026. After the Digital Omnibus changes, rules for high-risk systems follow on 2 December 2027 and 2 August 2028 (Commission timeline).

As a private user. The Commission says use of an AI system in a personal, non-professional capacity is outside the AI Act. Regular use for economic benefit counts as professional, and then you are a “deployer” (Commission FAQ).

As a business. Deployers must clearly label deepfakes, and AI-generated text published to inform the public on matters of public interest unless it underwent human review or editorial control (quick facts). Providers of AI systems that talk directly with people, such as chatbots and AI agents, must make sure people know they are dealing with AI unless that is obvious (Commission FAQ).

In practice. Keep a human review step before a Bot publishes anything for the public, and if a Bot writes to people outside your company, say in its signature that the message was drafted with AI.

The only Grok Bot feature the docs list as region-locked is tagging @bot on X. It goes by the country X has on record for your account, and “your current location and any VPN have no effect” (docs). A VPN does not help here.

The legal route. You don’t need tagging to work with X. Paste the post’s link into a chat with your Bot: Bots can search X and read posts and profiles, even without a connected X account (changelog, v0.70.2).

What the rules say. The rule you would break with a VPN or an account registered elsewhere is in your contract with xAI. Its Acceptable Use Policy forbids “circumventing any rate limits or restrictions or protective measures and safety mitigations” (AUP), and its terms require “accurate and complete information to register for an account” (Terms). Grok Bot’s own terms make its use subject to the provider’s acceptable use policy (Grok Bot Terms, section 1.1).

The risk. The terms let xAI suspend or terminate access if you violate the terms or the Acceptable Use Policy. For users in the EEA, UK and Switzerland this needs a “reasonable and valid basis”, and a terms violation is named as one (Terms, Europe Specific Terms).