ICO opens investigation into X over non-consensual sexual imagery

The Information Commissioner’s Office (ICO) has opened formal investigations into the social media platform X and its parent company, xAI, concerning the processing of personal data by the company's artificial intelligence (AI) system, Grok AI. The investigations follow reports that the technology has been used to generate non-consensual sexual images, including content involving children. The ICO is assessing whether X complied with UK data protection law, specifically whether personal data was processed lawfully and whether appropriate safeguards were implemented during Grok’s design and deployment.

In a statement, ICO Executive Director William Malcolm said that the reports raise troubling questions about the use of personal data to create intimate images without consent. He warned that such a loss of control poses immediate and significant harm to the public. The ICO is coordinating its efforts with Ofcom and other international regulators to ensure a joined-up approach to digital safety and privacy. While other agencies address online safety, the ICO’s investigation will focus on data rights and accountability. 

In related news, Ofcom has provided an update on its investigation into X. The regulator is currently using legally binding powers to gather evidence. However, the case has highlighted significant regulatory gaps in the Online Safety Act 2023 (OSA), as many AI chatbots currently fall outside its scope if they do not allow user-to-user interaction or search the wider internet. Specifically, Ofcom is currently unable to investigate the standalone Grok service for the creation of non-consensual sexual images due to these legislative limitations. Despite this, the regulator is examining whether xAI, the service provider, must implement stricter age-verification checks required for platforms publishing pornographic material. 

Meanwhile, in Europe, both Spain and Greece have announced proposals to ban social media use for under-16s. In France, cybercrime prosecutors and Europol conducted a raid on X's office in Paris while also summoning Elon Musk and the company's former chief executive for questioning over the matter. 

Responding to the developments in Spain, Musk referred to the Prime Minister, Pedro Sánchez, as "Dirty Sánchez," labelling him a tyrant and traitor to the Spanish people.

Training Announcement: The BCS Foundation Certificate in AI examines the challenges and risks associated with AI projects, such as those related to privacy, transparency and potential biases in algorithms that could lead to unintended consequences. Explore the role of data, effective risk management strategies, compliance requirements, and ongoing governance of the AI lifecycle and become a certified AI Governance professional. Find out more.