The Information Commissioner’s Office has opened formal investigations into X Internet Unlimited Company and X.AI over their handling of personal data relating to the Grok artificial intelligence system.
The regulator said the investigations followed reports that Grok was used to create non-consensual sexualized images and videos of people, including children. The alleged creation and distribution of such content raises “serious concerns” under UK data protection law and poses a risk of significant harm to the public, the ICO said.
The investigation will examine whether personal data was processed lawfully, fairly and transparently, and whether appropriate safeguards were built into Grok’s design and deployment to prevent the creation of harmful manipulated images using personal data. The ICO said failures in such safeguards could result in individuals losing control of their personal data, thereby suffering immediate and lasting harm.
The move follows a public statement from the regulator on January 7 in which it confirmed it had contacted both companies to seek urgent information about the reports.
William Malcolm, executive director of regulatory risk and innovation at the ICO, said the allegations raised “deeply concerning questions” about the use of people’s personal data without their knowledge or consent.
“Such a loss of control over personal data can cause immediate and significant harm, particularly when children are involved,” he said. “Our investigation will assess whether X Internet Unlimited Company and
The ICO said it was working closely with Ofcom and international regulators to ensure a coordinated approach to online security, privacy and data protection when rolling out AI technologies.
The regulator added that it will take enforcement action if it finds that data protection obligations have not been met. It said it would have no further comment while the investigation was ongoing.
