UK ICO Opens Formal Investigations into X's Processing of Personal Data for Grok AI, February 2026

On 3 February 2026, the Information Commissioner's Office (ICO) opened formal investigations into X Internet Unlimited Company (XIUC) and X.AI LLC (X.AI) covering their processing of personal data in connection with the Grok artificial intelligence system. The ICO published a public statement on the same date. The action is at the formal investigation stage; no enforcement notice or monetary penalty notice has yet been issued.

The governing authority is the UK General Data Protection Regulation (UK GDPR) as retained in domestic law by the European Union (Withdrawal) Act 2018, supplemented by the Data Protection Act 2018. The ICO's investigative powers derive from Part 6 of the Data Protection Act 2018, specifically sections 119–146 on information notices and assessment notices. The investigation focuses on whether XIUC and X.AI are processing personal data of UK residents in compliance with the principles in Article 5 of the UK GDPR, and whether the basis for using that data to train Grok meets the lawfulness requirements of Article 6. A stated concern is the potential for Grok to produce harmful sexualised image and video content derived from personal data.

Social media platform operators deploying AI systems trained on user-generated content face direct scrutiny. Any operator that has scraped, licensed, or otherwise processed UK resident data for AI model training must be able to demonstrate a lawful basis, assess risks to data subjects, and maintain records under Article 30. Operators relying on legitimate interests under Article 6(1)(f) must have conducted a balancing test. Operators that have not reviewed their data processing documentation since the deployment of AI training pipelines should treat this investigation as a signal to conduct immediate compliance reviews. Third-party processors providing AI infrastructure to platforms serving UK users are equally exposed where they act as joint controllers or independent controllers.

The ICO has not stated a fixed timeline for completing the investigation. Prior large-scale investigations under the Data Protection Act 2018 have taken between twelve and thirty-six months to result in enforcement decisions. The ICO retains power to issue assessment notices, information notices, enforcement notices, and monetary penalty notices of up to £17.5 million or 4% of global annual turnover, whichever is higher. Investigations may be closed without formal action if the controller makes sufficient undertakings.

Our firm advises on UK and EU data protection law, AI regulatory compliance, and cross-border enforcement matters. We maintain dedicated partnerships to assist clients in responding to ICO investigations, data subject rights exercises, and AI governance reviews. Contact us to discuss your specific position. We handle matters including GDPR compliance audits, AI training data assessments, data processing agreements, controller-processor arrangements, lawful basis documentation, and ICO engagement strategy.

Source: Information Commissioner's Office, "ICO announces investigation into Grok," Statement, 3 February 2026. https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/ico-announces-investigation-into-grok/

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.