The Information Commissioner’s Office (ICO) has launched a formal investigation into Elon Musk’s X and xAI companies following reports that the Grok AI tool generated indecent deepfake images without consent. The inquiry will examine whether the firms breached UK data protection law, including GDPR.
The move comes after Grok was used to mass-produce sexualised deepfakes, with researchers estimating 3 million such images were created in under two weeks, including 23,000 that appeared to depict children. The ICO’s executive director, William Malcolm, said the reports raised “deeply troubling questions” about how personal data was used to generate intimate images without knowledge or consent.
Under GDPR, breaches can result in fines of up to £17.5 million or 4% of global turnover. X’s advertising revenue was estimated at $2.3 billion last year, which could imply a fine of around $90 million. Iain Wilson, managing partner at Brett Wilson, described the potential breaches as “difficult to imagine a more egregious breach of data protection law”.
Separately, Ofcom said it was not investigating xAI at present, as chatbot activities are not fully covered by the Online Safety Act, but it is considering an investigation into whether the app complies with age-gating rules for pornographic content. Meanwhile, a cross-party group of MPs led by Anneliese Dodds has urged the government to introduce AI legislation requiring thorough risk assessments before product release.
X and xAI have announced measures to counter abuses, but regulatory and legal scrutiny continues. French prosecutors raided X’s Paris headquarters earlier this year as part of a separate investigation into child abuse images and deepfakes. The ICO investigation will assess whether appropriate safeguards were built into Grok’s design and deployment.
