The Information Commissioner’s Office (ICO) has opened formal investigations into X and xAI over their processing of personal data in relation to Grok’s recent generation of sexualised deepfake images and videos that circulated on social media platform X.

The ICO says it has taken this step following the reports that Grok has been used to generate non-consensual sexual imagery of individuals, including children.

The reported creation and circulation of such content raises “serious concerns” under the UK data protection law, while presenting risks and potential harm to the public.

These concerns relate to whether personal data has been processed lawfully, fairly and transparently, and whether appropriate safeguards were built into Grok’s design and deployment to prevent the generation of harmful manipulated images using personal data.

Where those safeguards fail, individuals lose control of their personal data in ways that expose them to serious harm. Examining these risks is central to the ICO’s role in protecting people’s rights and holding organisations to account as they design and deploy AI technology.

This follows the ICO’s previous public statement on 7 January, in which it confirmed that it had contacted XIUC and X.AI to seek urgent information about these reports.

“The reports about Grok raise deeply troubling questions about how people’s personal data has been used to generate intimate or sexualised images without their knowledge or consent, and whether the necessary safeguards were put in place to prevent this. Losing control of personal data in this way can cause immediate and significant harm. This is particularly the case where children are involved,” William Malcolm, executive director regulatory risk and innovation at the ICO said.

“Our role is to address the data protection concerns at the centre of this, while recognising that other organisations also have important responsibilities. We are working closely with Ofcom and international regulators to ensure our roles are aligned and that people’s safety and privacy are protected. We will continue to work in partnership as part of our coordinated efforts to create trust in UK digital services.

“Our investigation will assess whether XIUC and X.AI have complied with data protection law in the development and deployment of the Grok services, including the safeguards in place to protect people’s data rights. Where we find obligations have not been met, we will take action to protect the public.”

Ofcom has also provided an update on its investigation into X concerning its alleged breach of the Online Safety Act – the regulator is currently analysing evidence on whether X has broken the law, and has made a request to the social media firm for relevant information regarding the case.

Recommended

• X Stops Grok Generating Revealing AI Deepfakes Following Backlash
• EU Opens Investigation Into X Over Grok AI Deepfakes
• X Under Fire Over ‘Staggering Amplification of Hate’ During UK Riots
• X Limits Grok AI Images to Subscribers Following Deepfake Outcry

In Ofcom’s update, it explained that it currently is not investigating xAI, the company behind chatbot Grok, as it does not fall under the scope of regulated AI chatbots.

Under the Online Safety Act, only user-to-user services are regulated, meaning that a chatbot would not be subject to regulation if they only allow user to chatbot interactions, do not search mutiple websites or act as a search service, and as long as they cannot generate pornographic content.

While Grok generated sexually explicit images, these would not likely be classified as pornography, therefore under its current scope, Ofcom cannot take action against xAI under the Online Safety Act.

The ICO, which investigates data protection, is not hampered from investigating the chatbot firm directly, however.