Ofcom spent nine months on this. Here is what it can and cannot do.

A message arrives from a number you do not know. One line, then a link.

She opens it on the bus. It is her face. Not a photograph of her, one of her, made.

What she does next in the first ten minutes turns out to matter more than anything a regulator has done in nine months.

On 12 January this year, Ofcom opened a formal investigation into the company behind X. The trigger was reports that the Grok chatbot account on the platform was being used to make and share sexual deepfakes of real people, including children.

On 14 October, Ofcom published an update. It is the most complete account so far of what a regulator can actually do about this, and it is more limited than most people assume.

## What the investigation found, and what it dropped

Ofcom used its formal powers to gather what it describes as an extensive amount of information, and examined three things: how X assessed the risk of illegal content appearing, how easy it was for users to report it, and how X handled the moderation decisions it made afterwards.

Then it narrowed the case. It is now focused on whether X complied with its duties to protect people in the United Kingdom from illegal content. It has set aside, for now, the children's risk assessment duties, the children's safety duties, and the reporting duties on content harmful to children. Ofcom states plainly that it is making no findings on those, and that it may revisit them.

The reason for dropping them is not that they were fine. It is that X fixed one thing after Ofcom raised it. During the evidence gathering, Ofcom found that in certain circumstances age-gated pornographic material stayed visible to accounts that had not been verified as belonging to an adult. X changed its systems so that material labelled as pornography is now consistently blocked from accounts that have not completed age assurance.


Separately, X's first quarterly report on hate and terror content showed faster review times and performance inside the targets it agreed in May: an average of 24 hours, with at least 85% reviewed within 48. Ofcom's response was that speed is not the same as effectiveness, that it has ongoing concerns about what actually comes down, and that reports about X's work with external experts have been mixed. It will publish more early next year.

## The standalone app is where the law runs out

Here is the part that matters most for anyone using these tools.

When Ofcom opened the case in January, it could not investigate the creation of images inside the standalone Grok service. Not because it chose not to. Because the Online Safety Act does not cover chatbots in that way. Ofcom has called this a gap more than once.

What happened instead was negotiation. After engagement with Ofcom, SpaceXAI, formerly xAI, blocked users from generating or viewing images of real people in revealing clothing such as bikinis. Later, it went further for Britain: people with UK IP addresses are now blocked from viewing, generating or sharing pornographic content through Grok's image tools, in the app or through links. It also restricted its companion chatbots, including one called Ani, from sexually explicit conversations with UK users.

Ofcom says it will keep monitoring whether those restrictions hold. It does not say they are enforceable, because under the Act as written, they mostly are not.

## How far the regulator's arm reaches

If Ofcom concludes there are reasonable grounds to believe X failed its duties, it issues a provisional view. X responds. Then a final decision. Fines can reach £18 million or 10% of qualifying worldwide revenue, whichever is greater.

The heavier tool is a court order that cuts off a platform's payments, advertisers or access in the UK. Ofcom's own description carries the condition: a court may impose such orders only where they are appropriate and proportionate to prevent significant harm to individuals in the United Kingdom.

Melanie Dawes, Ofcom's chief executive, told MPs on 20 October that the regulator considered seeking an urgent court order over the Grok deepfakes and did not, because the legal threshold was too high. She asked for the power to be changed.


One more thing that surprises people. Ofcom does not handle individual complaints and cannot order an individual image down. It regulates systems, not cases.

## What I take from it

I do not think the answer here is that regulation failed. Nine months ago this was barely a category of harm with a name. There is now an active investigation, a set of restrictions specific to UK users, and a regulator publicly asking Parliament for the power it needed and did not have. That is movement.

What I take from it is narrower and more useful. The things that changed happened because a regulator asked, not because a court ordered. They arrived in October, ten months after the images started. And they cover Britain, because Britain asked.

Which means the first ten minutes still belong to the person holding the phone.

> The regulator moves in months. The image moves in seconds.

## What to do in the first ten minutes

One: save it before you report it.

Screenshot the image, the account, the URL and the timestamp. Keep the original file. Platforms remove things, accounts delete themselves, and a case without the image is much harder for anybody to act on.

Two: report it to the platform, and screenshot the report.

Both X and the standalone Grok service have reporting routes. Use them, and keep the confirmation. The record of you asking is part of the evidence.

Three: report it to the police.

Sharing intimate images without consent is a criminal offence in England and Wales, and the law has been tightened over the last two years to cover images that were generated rather than photographed. You can report online or by calling 101. If you are in immediate danger, 999. Keep the crime reference number.

Four: if the platform route stalls, use the specialist services.

The Revenge Porn Helpline at revengepornhelpline.org.uk helps adults in the UK get images taken down, including AI-generated ones, and it works across platforms. Report Harmful Content at reportharmfulcontent.com gives platform-specific routes. For anyone under 18, CEOP and Childline are the right doors, and a school's designated safeguarding lead can open them faster than a parent can.

Five: do not pay, and do not reply.

Most of these messages are designed to get one response. A reply tells whoever sent it that the number is live.

## One question

Ofcom's case now turns on whether X's system was good enough, not on who made any particular image. That is how this kind of law works, and it is probably the only workable way to do it.

But it leaves the person in the picture with a system built for averages.

So: if this happened to somebody you love, would they know the first thing to do in the first ten minutes? And have you ever told them?

---

Sources:

- Ofcom, investigation into X Internet Unlimited Company, opened 12 January 2026, last updated 14 October 2026, https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/investigation-into-x-internet-unlimited-company-and-its-compliance-with-duties-to-protect-its-users-from-illegal-content-and-child-users-from-harmful-content - Ofcom update: Monitoring X's response to hate and terror content, and Grok investigation latest, 14 October 2026, https://ofcom.org.uk/online-safety/illegal-and-harmful-content/ofcom-update-monitoring-xs-response-to-hate-and-terror-content-and-grok-investigation-latest - Ofcom chief executive Melanie Dawes giving evidence to the DCMS Committee, 20 October 2026, reported by MLex via TSN Media, https://tsnmedia.org/ofcom-grok-court-order/ - Reuters reporting on Grok continuing to generate sexualised images, https://www.businessday.co.za/world/2026-10-14-concerns-persist-over-xs-handling-of-illegal-content-uk-media-regulator/

Les actualités sont collectées automatiquement depuis des flux publics robotique & IA.