When I worked at EFF we argued in about 20 different contexts that tech companies are not responsible for user activity even if they know that some of it is unlawful in some way, and that tech companies do not have a duty to restrict users in order to deter some kind of unlawful behavior.
We said that about copyright infringement (again and again and again, including before the Supreme Court in MGM v. Grokster), about counterfeiting, about housing discrimination, about distribution of existing child porn, about manufacture of weapons, about evading law enforcement surveillance, and about every kind of tort in content moderation (the intermediaries do not have a duty to prevent people from publishing content that civilly harms others). Oh, also money laundering with cryptocurrency mixer code. And prostitution.
In every case EFF's position was that there might be unlawful ways to use technology but the technology developer or operator didn't have a duty to prevent or discourage it, or to design the technology to prevent or discourage it, or to help the government or private parties catch people doing something unlawful.
I know there are several different legal doctrines in play there and some of them may have limitations in terms of actual knowledge (although EFF usually also argued for defining this narrowly!), so maybe one could argue that if Grok obtains actual knowledge of some improper use that it might have a duty to prevent that use in that case. But it would have been historically exceptional for EFF to say that there was a general duty to design technology to deter or detect any form of unlawful use.
There may also be a distinction in several of the relevant legal doctrines between inventing a technology (or making it available to others to use themselves on their own devices) versus hosting it on a cloud service, where the operator has more knowledge and more control than in other settings. EFF still historically preferred in basically every case to try to minimize the technology creator's or operator's liability for what users did.
The concerns on Grok seem pretty specific: to not take for granted that it doesn’t introduce problems with how Twitter handles user data, not what users can do with it.
From the article:
“These sweeping assurances that corporate restructuring led to a fundamental change in X’s policy and practices around user data should be met with a healthy dose of skepticism, given evidence to the contrary. For example, the company’s quiet rollout integrated its AI model Grok with the platform in 2024, trained (without meaningful consent) on X user data. The company was also subject to a massive data breach in 2025.”
Nothing about groks capabilities or what users are allowed to ask it.
> X Corp.’s flagship product since its identity change—a generative AI model called Grok—has created shocking amounts of child sexual abuse material (“CSAM”) and other nonconsensual sexual imagery. X Corp.’s generation of CSAM and other nonconsensual imagery was so egregious that it sparked several investigations and lawsuits, including by a bipartisan coalition of 35 state attorneys general and international law enforcement.
I guess it is complicated by the context that the letter goes on to claim that these capabilities were partly enabled by misuse of personal data (the underlying issue before the FTC here), which leaves open some possibility that EFF would agree that X should not be liable for users' use of Grok if it had been created by some other means.
If it was about capabilities of downloaded software, I don't think it would even be a close question. For cloud services I can see that it can get more complicated, because the service operator would be straightforwardly able to choose to have more knowledge or choose to exercise more control. (But in other cases where the services had a somewhat more passive role, EFF regularly argued that companies shouldn't have to proactively monitor how people used them, even if they could.)
The EFF is not consistent in its principles. It has partisan bias. However, it can still be worth situationally supporting for certain causes.
They're arguing X is a massive privacy risk and should not get any exemptions.
The EFF's mission statement supports them prioritizing freedom and innovation over privacy.
It's trivially easy to see cases where freedom+justice+innovation can conflict with each other (it's even trivially easy to see where they can conflict with each other specifically for innovations involving the reduction of privacy, ye olde panopticon.)
So it's also trivially simple to understand that at some point you're gonna have to pick one over another. And note that freedom is the first word in that list.
Which is why I would like the EFF to support freedom.
What about the sentence right before the mission statement? [1]
> The Electronic Frontier Foundation is the leading nonprofit organization defending civil liberties in the digital world. Founded in 1990, EFF champions user privacy, free expression, and innovation through impact litigation, policy analysis, grassroots activism, and technology development. EFF's mission is to ensure that technology supports freedom, justice, and innovation for all people of the world.
> The EFF's mission statement supports them prioritizing freedom and innovation over privacy.
For as long as I've known about EFF (which is less than a decade, I admit), EFF has never seemed to prioritize "innovation" over privacy. As for freedom, privacy often is a prerequisite.
It gives the ability to speak and communicate without fear of being censored or surveillance (edit to add: and when there is censorship & surveillance it gives helps regain some of said freedom). It supports other freedoms like voting and freedom of association. It reduces the ability of others to harass or threaten or stalk you, making your daily life easier. It allows for whistleblowing against illegal acts of companies or government entities. Journalists and their sources often need it as part of their ability to freely do their jobs.
And they often contradict.
People should have freedom from abuse of their images, your freedom to abuse them
Edit: fixed "freedom of" to "freedom from", thanks to Alpha3031
Basic human decency?