The formal investigation follows an announcement last month that the ICO was seeking urgent information from X and xAI, amid widespread reports that Grok had been used to generate sexualized images of children and adults.
William Malcolm, executive director for regulatory risk and innovation at the ICO, said the reports about Grok “raise deeply troubling questions about how people’s personal data has been used.”
“Losing control of personal data in this way can cause immediate and significant harm. This is particularly the case where children are involved,” Malcolm said. “Where we find obligations have not been met, we will take action to protect the public.”
While the ICO’s investigation will focus on X and xAI’s compliance with U.K. data protection law, Malcolm said it would work closely with other regulators in the U.K. and abroad that are also investigating the issue.
Ofcom, the U.K.’s communications regulator, opened a formal investigation into X last month under the Online Safety Act. That investigation is ongoing, Ofcom said on Tuesday. It is progressing “as a matter of urgency” but could take “months,” Ofcom added, noting that it must follow a “fair process” and “it would not be appropriate to provide a running commentary.”
Ofcom also said it is not currently investigating xAI, which provides the standalone Grok AI tool, noting that “it can only take action on online harms covered by the [OSA].” The act does not apply to AI tools which do not involve searching the internet, interacting with other social media users, or generating pornography, it said.