Open
X Internet Unlimited Company (XIUC) with respect to its service X
12 January 2026
We are investigating whether the provider of X, XIUC, has failed/is failing to comply with its duties under the Online Safety Act 2023 in respect of its:
- Duties to carry out a suitable and sufficient illegal content risk assessment;
- Safety duties about illegal content;
- Duties to carry out a suitable and sufficient children’s risk assessment; and,
- Safety duties protecting children.
Sections 9, 10, 11, 12, 20, 21 and 22 of the Online Safety Act 2023.
Since opening our investigation, we have gathered and analysed an extensive amount of information – using our formal powers – to examine XIUC’s compliance with a range of duties under the Online Safety Act 2023. This includes its duties to protect all UK users from non-consensual intimate images and child sexual abuse material – and to protect children in the UK from seeing pornography.
Based on the evidence we have gathered and analysed so far, we have decided to focus on XIUC’s compliance with its duties to protect people in the UK from illegal content, which will enable us to progress our case in a timely and efficient way.
If, based on the evidence, we have reasonable grounds to believe that XIUC has failed to comply with its duties, we will issue a provisional notice of contravention setting out our views and the evidence upon which we are relying. XIUC will then have an opportunity to respond to our provisional findings in full, as required by the Act, before we reach a final decision.
XIUC’s measures to protect children from pornographic content on X
After analysing evidence obtained to date, we identified concerns with the operation of XIUC's safety measures to protect children from pornography on X. Specifically, we found that in certain circumstances age-gated pornographic material remained accessible to accounts that had not been verified as belonging to users aged 18 or over. However, these concerns would only have been encountered under specific conditions and were not directly related to the widespread reports about methods of accessing Grok on X that led to the opening of this investigation.
In response to us raising these concerns with XIUC, it implemented immediate changes so that pornographic content behind age gates is consistently restricted for accounts that have not completed age assurance via XIUC’s designated methods.
Next steps for the investigation
As a result of the changes XIUC has made to address our concerns about its safety measures to protect children from pornographic material, we have decided to focus on XIUC’s compliance with its duties to protect people in the UK from illegal content on X.
This means, at this time, we are not taking forward our assessment of XIUC’s compliance with the following duties:
- children’s risk assessment duties (section 11);
- children’s safety duties (section 12); and
- reporting and complaint duties in respect of content that is harmful to children (section 20(4) and section 21(5)).
We are making no findings on XIUC’s compliance with these duties at this point and, should further information come to light, we may revisit this.
Our investigation continues to gather additional evidence and examine whether we have reasonable grounds to believe that XIUC has failed to comply with one or more of the duties remaining in scope.
We aim to publish a further update later this year.
Background
Part 3 of the Online Safety Act (‘the Act’) imposes duties on providers of regulated user-to-user (‘U2U’) services to prevent users encountering illegal content and children encountering harmful content. The Act also requires U2U services in scope of the Act to consider the risks of harm presented by its service to its users by carrying out a:
- suitable and sufficient illegal content risk assessment; and
- suitable and sufficient children’s risk assessment (where the service is likely to be accessed by children).
The duty to carry out an illegal content risk assessment came into effect on 16 March 2025, and a children’s risk assessment on 24 July 2025.
In addition, Part 3 of the Act imposes duties on providers of regulated U2U services to, among others:
- take or use proportionate measures to prevent individuals from encountering priority illegal content – including intimate image abuse and Child Sexual Abuse Material (‘CSAM’) – by means of the service;
- effectively mitigate and manage:
- the risk of the service being used for the commission of priority offences; and
- the risks of harm to individuals, as identified in the most recent ‘Illegal Content Risk Assessment’;
- implement systems and processes designed to minimise the length of time for which any priority illegal content is present and swiftly take it down when they are made aware of its presence;
- use proportionate systems and processes designed to prevent children of any age from encountering, by means of the service, primary priority content – including pornographic content – that is harmful to children. This includes the use of highly effective age assurance to prevent children from encountering primary priority content; and
- effectively mitigate and manage the risks of harm to children, as identified in the most recent ‘Children’s Risk Assessment’.
Providers are also required to allow for users to easily report illegal content and content that is harmful to children, in addition to operating complaints procedures in relation to such content. Providers are required to provide for appropriate action to be taken in response to complaints.
The duties relating to illegal content came into effect on 17 March 2025, and the duties to protect children from harmful content came into effect on 25 July 2025.
Investigation
Ofcom has today opened an investigation into XIUC’s compliance with its duties under the Act. The investigation follows widespread reports that a Grok model on X is/was being used to generate and share content that may amount to intimate image abuse, CSAM and pornography that is accessible to children.
Ofcom’s investigation will seek to establish whether there are reasonable grounds to believe that XIUC has failed, or is failing, to comply with its legal obligations as set out above.
Ofcom’s Online Safety Enforcement Guidance sets out how Ofcom will normally approach enforcement under the Act. This includes our approach to information gathering and analysis and the procedural steps we must take to fairly determine the outcome of the investigation.
Where we identify compliance failures, we can impose fines of up to £18m or 10% of qualifying worldwide revenue (whichever is greater). In the most serious cases of ongoing non-compliance, and where appropriate given the risks of harm to individuals in the UK, we can make an application to a court for ‘business disruption measures’, through which a court could impose an order, on an interim or full basis, requiring payment providers or advertisers to withdraw their services from a platform, or requiring internet service providers to block access to a site in the UK. The court may only impose such orders where appropriate and proportionate to prevent significant harm to individuals in the UK.
We will provide an update on this investigation as soon as possible.