UK regulator launches investigation into Elon Musk’s X after Grok deepfakes controversy

Formal investigations have been launched into whether Elon Musk’s X and xAI have complied with data protection law after the chatbot Grok was used to create sexualised deepfake images.

The Information Commissioner’s Office (ICO) confirmed it had opened the investigations on Tuesday afternoon. In a statement, it said the reports raised “serious concerns” under UK data protection laws, such as whether “appropriate safeguards were built into Grok’s design and deployment”.

It comes after outrage over Grok’s ability to digitally “strip” victims without their consent, generating deepfake images of them nude or in minimal clothing. Women told The Independent they had been left feeling “violated and humiliated” after the “dehumanising” images were created by the chatbot.

open image in gallery

X has since said it has brought in measures to address the issues raised.

William Malcolm, executive director of regulatory risk and innovation at the ICO, said the office is “working closely with Ofcom” and other regulators to “ensure that people’s safety and privacy are protected”.

He added the loss of personal data in this way “can cause immediate and significant harm”.

In January, technology secretary Liz Kendall encouraged Ofcom to use “the full range of its powers” under the Online Safety Act after the regulator announced an investigation into whether X has complied with UK laws.

In a previous statement, Ofcom said it will determine whether X “has complied with its duties to protect people in the UK from content that is illegal”.

The communications regulator said unlike the ICO, it was not investigating xAI, which provides the standalone Grok chatbot app, because of the way the Online Safety Act relates to chatbots.

open image in gallery

“When we opened our investigation into X, we said we were assessing whether we should also investigate xAI, as the provider of the standalone Grok service,” it said.

“We continue to demand answers from xAI about the risks it poses. We are examining whether to launch an investigation into its compliance with the rules requiring services that publish pornographic material to use highly effective age checks to prevent children from accessing that content.

“Because of the way the Act relates to chatbots, as explained above, we are currently unable to investigate the creation of illegal images by the standalone Grok service in this case.”

Ministers brought forward legislation to ban generating sexual deepfake images without consent following outrage over the chatbot. Shortly after the ban, Sir Keir Starmer said X must act to comply with UK laws “immediately” and that “young women’s images are not public property, and their safety is not up for debate”.

In a statement released on Tuesday, Mr Malcolm said: “The reports about Grok raise deeply troubling questions about how people’s personal data has been used to generate intimate or sexualised images without their knowledge or consent, and whether the necessary safeguards were put in place to prevent this. Losing control of personal data in this way can cause immediate and significant harm. This is particularly the case where children are involved.

“Our role is to address the data protection concerns at the centre of this, while recognising that other organisations also have important responsibilities. We are working closely with Ofcom and international regulators to ensure our roles are aligned and that people’s safety and privacy are protected. We will continue to work in partnership as part of our coordinated efforts to create trust in UK digital services.

“Our investigation will assess whether XIUC [X Unlimited Internet Company] and X.AI have complied with data protection law in the development and deployment of the Grok services, including the safeguards in place to protect people’s data rights. Where we find obligations have not been met, we will take action to protect the public.”