UK Data Protection Regulator Launches Inquiry into xAI Over Grok Chatbot

The UK’s Information Commissioner’s Office (ICO) has launched a formal investigation into Elon Musk’s xAI, specifically examining data handling practices through its Grok chatbot. The probe, announced on Tuesday, follows reports that Grok was used to create and share AI-generated sexualized images of real people.

The regulator cited these reports as raising serious concerns under UK data protection law and a potential risk of harm to the public. The investigation will assess whether xAI processed personal data lawfully and implemented adequate safeguards against harmful deepfakes.

Under UK regulations, the ICO can impose fines of up to £17.5 million ($24 million) or 4% of annual sales, whichever is higher. The agency is also working with communications regulator Ofcom and international organizations on the matter.

Why Did the Regulator Take Action?

The probe was triggered by reports that Grok was used to generate non-consensual deepfake content involving real individuals, particularly women and children. The ICO emphasized the risk of significant harm to the public and cited this as grounds for the investigation.

The regulator is examining whether xAI’s data protection measures were sufficient to prevent the misuse of its AI systems. This follows prior contact with the Irish entity responsible for X users in Europe, as well as with xAI itself.

How Are International Bodies Involved?

The investigation is not the only regulatory action in recent days. French law enforcement raided X’s offices in Paris on Tuesday as part of a separate criminal inquiry into alleged misuses of the platform, including deepfakes.

William Malcolm, a representative from the ICO, noted the collaboration with communications regulator Ofcom and international partners. Ofcom indicated that Grok’s standalone app would not fall under its own investigation, as content from the app is not automatically made public.

This international cooperation reflects growing regulatory scrutiny around AI and content moderation on major platforms. The involvement of multiple regulatory bodies underlines the cross-border nature of the issue.

What Are the Next Steps for xAI?

xAI will need to respond to the ICO’s findings and potentially implement changes to its data handling practices. The company’s compliance with UK data protection laws will be scrutinized in detail.

The outcome could set a precedent for how regulators handle AI-generated content. If xAI is found in violation, the potential fines could signal a broader enforcement strategy against platforms that fail to address harmful AI outputs.

The company’s ability to demonstrate safeguards against misuse will be critical in mitigating regulatory risks. This inquiry could also influence future compliance efforts across the AI industry.