The Information Commissioner’s Office has launched formal investigations into X Internet Unlimited Company and X.AI over their handling of personal data in connection with the Grok artificial intelligence system.
The regulator said the probes follow reports that Grok has been used to generate non-consensual sexualised images and videos of individuals, including children. The alleged creation and circulation of such content raises “serious concerns” under UK data protection law and presents a risk of significant harm to the public, the ICO said.
The investigation will examine whether personal data has been processed lawfully, fairly and transparently, and whether adequate safeguards were built into Grok’s design and deployment to prevent the generation of harmful manipulated imagery using personal data. The ICO said failures in such safeguards could lead to individuals losing control of their personal data in ways that expose them to immediate and lasting harm.
The move follows a public statement issued by the regulator on 7 January, when it confirmed it had contacted both companies to seek urgent information about the reports.
William Malcolm, executive director for regulatory risk and innovation at the ICO, said the allegations raised “deeply troubling questions” about the use of people’s personal data without their knowledge or consent.
“Losing control of personal data in this way can cause immediate and significant harm, particularly where children are involved,” he said. “Our investigation will assess whether X Internet Unlimited Company and X.AI have complied with data protection law in the development and deployment of Grok, including whether appropriate safeguards were in place to protect people’s data rights.”
The ICO said it is working closely with Ofcom and international regulators to ensure a coordinated approach to online safety, privacy and data protection as AI technologies are rolled out.
The regulator added that it would take enforcement action if it finds data protection obligations have not been met. It said it would not provide further comment while the investigation is ongoing.
