The United Kingdom opens investigation into platform X over "sensitive" images generated by Grok: Government tightens platform accountability

According to an Ofcom statement, the regulator said it had urgently contacted X as early as 5 January 2026 and set a deadline of 9 January 2026 for the company to explain the steps taken to comply with its statutory obligations; after receiving the response, Ofcom conducted a rapid assessment and decided to open an investigation.

The focus of the investigation centres on whether X has properly complied with its obligations under the Online Safety Act 2023, in particular the requirements to assess the risks of users in the United Kingdom being able to access illegal content, and to update risk assessments ahead of major service changes; to prevent “priority illegal content”, including non-consensual intimate images and child sexual abuse material (CSAM); to remove illegal content swiftly once the platform is aware of it or has been notified; to put in place measures that take account of the protection of privacy rights; to assess risks to children and update such assessments prior to significant changes; and to apply effective age-verification measures to prevent children from accessing pornographic content.

Ofcom also stressed that it is not a body that “censors” individual posts, but rather assesses whether platforms have appropriate systems, processes and resources in place to mitigate risks and address violations in accordance with the law.

According to Reuters, UK Prime Minister Keir Starmer criticised this type of content as “disgusting” and “illegal”, while expressing support for Ofcom’s investigative action.

From a policy perspective, a number of international media outlets have noted that the UK government is pushing forward steps to tighten regulation of the creation or commissioning of non-consensual intimate images using AI, treating this as a category of violations requiring strict handling within the framework of online safety legislation and related statutes.

On the corporate side, Reuters reported that X has restricted certain image-generation features of Grok (for example, narrowing access), and has stated that it removes infringing content and bans accounts that post illegal material.

Some sources have also recorded the implementation of “access restrictions” amid growing pressure from regulators and users. However, Reuters had previously published a separate analysis indicating that the abuse of “sensitive” image generation has become widespread, including cases in which victims reported being targeted, and referred to a controversial response from xAI when questioned by the media on the issue. Notably, Ofcom stated that, in addition to X’s response, it also received a response from xAI (on 9 January) and is assessing whether there are indications of compliance issues related to the provision of Grok in order to clarify the matter further.

The matter is not confined to the United Kingdom. Reuters reported that France and India have also taken steps to seek clarification or refer the issue to the competent authorities, in connection with content alleged to be pornographic or sexually exploitative that has been generated and disseminated via generative tools on platforms.

In Southeast Asia, Indonesia and Malaysia have been recorded as countries that have adopted restrictive measures or “blocked” Grok amid concerns that the tool is being misused to create offensive or non-consensual content.

Ofcom stated clearly that, should it conclude that X has breached the law, it may require the platform to take specific steps to remedy the breaches or prevent recurrence; and may impose fines of up to £18 million or 10% of global turnover, whichever is higher.

In “serious” cases of “persistent non-compliance”, Ofcom may apply to the courts for “business disruption measures”, such as requiring payment service providers or advertising intermediaries to withdraw their services, or requiring network operators to block access in the United Kingdom, subject to the principles of appropriateness and proportionality in order to prevent a risk of significant harm.

Developments in the United Kingdom illustrate a regulatory approach that is shifting from “post-violation enforcement” towards requiring platforms to demonstrate preventive systems (risk assessment, age assurance, rapid takedown procedures, and privacy protection). This is also a trend being pursued by many countries as generative content develops rapidly, while the boundary between “new technology” and “unlawful conduct” becomes increasingly susceptible to abuse.

Why is the Grok case regarded as an AI governance “flashpoint”?

- High speed of dissemination: generative content can be produced at scale and can “outpace” the capacity of traditional moderation mechanisms.

- Risks of victimisation: non-consensual intimate images constitute a form of infringement of privacy and dignity, and may lead to extortion, defamation, and online harassment.

- The child protection challenge: requirements on age verification and mechanisms to block pornographic content have become key compliance benchmarks for platforms under the Online Safety Act.