The Information Commissioner’s Office has opened formal investigations into X and xAI covering their processing of personal data in relation to the Grok AI chatbot and its potential to produce harmful sexualised images and video content. This follows reports that Grok has been used to generate non-consensual sexualised images of individuals, including children. The ICO says that the reported creation and circulation of this content raises concern under UK data protection law. From 6 February 2026, it will be unlawful to create or request creation of such images under the Data Use and Access Act 2025.
The concerns relate to whether personal data has been processed lawfully, fairly and transparently, and whether appropriate safeguards have been built into Grok’s design and use to prevent generation of harmful images using personal data. Individuals lose control of their personal data in ways that may expose them to serious harm.
The ICO highlights that controllers developing AI systems that process personal data must ensure that personal data is processed lawfully, fairly and transparently and that individuals’ data protection rights can be exercised effectively. They must also ensure that risks to people, particularly children and vulnerable groups are identified and mitigated, and high-risk processing, like the creation or use of synthetic or manipulated images, is subject to appropriate safeguards.
As well as the ICO investigation, Ofcom has also set out the next steps in its own investigation into X and has also described the limitations of the UK’s Online Safety Act (OSA) in relation to AI chatbots. Since the launch of Ofcom’s investigation into whether X had done enough to assess and mitigate the risk of these images spreading, X has said it has implemented measures to address the issues.
Ofcom is also examining whether to launch an investigation into X’s compliance with rules requiring services that publish pornographic material to use highly effective age checks to prevent access by children. Because of the way the OSA relates to chatbots, Ofcom is currently unable to investigate creation of illegal images by the standalone Grok service. AI-generated content is only covered by the illegal content and children’s safety duties in Part 3 of the Act if it is shared by users with each other or encountered in or via search results. One-to-one interaction between a user and chatbot that does not involve searching the internet or sharing with other users is not regulated under Part 3 but could be under Part 5 if pornographic.
