Ireland opens investigation into X over Grok: sexualized deepfake images of real people under regulators' scrutiny

On platform X in recent weeks a wave of prompts has run in one direction: requests for the AI tool Grok to “strip” people into underwear or create sexualized versions of their photos.

If you're active on X, it was impossible not to notice this trend. Repeated attempts appeared to test the system's limits – from edits of ordinary portrait photos to explicitly worded requests for intimate manipulations.

Even at the first signs of this trend the question arose: could such a functionality – or its insufficient restriction – be acceptable from a regulatory perspective?

These were situations where users prompted the account @ Grok to create edited versions from existing photos – for example in underwear or otherwise sexualized. In some cases the subjects were reportedly minors.

This is no longer just a hypothesis. Regulators have stepped in.

Irish DPC: formal inquiry under the GDPR

The Irish Data Protection Commission (DPC) on 17 February 2026 announced the start of a formal investigation into X Internet Unlimited Company (XIUC), which is the platform X's European entity.

The DPC will examine in particular:

• whether the generation of these outputs involved processing personal data in violation of the GDPR,
• whether the principles of "data protection by design" were observed,
• whether X carried out an appropriate data protection impact assessment (DPIA),
• whether risk scenarios associated with the deployment of the AI tool were adequately managed.

In its statement the DPC speaks of the “apparent creation and publication” of potentially harmful sexualized image outputs of real people via Grok.

As the lead supervisory authority for X in the EU, the DPC's decision could have an impact across all EU and EEA member states.

Parallel actions in the United Kingdom

The UK's Information Commissioner's Office (ICO) on 3 February 2026 opened its own investigation concerning the processing of personal data in connection with Grok.

At the same time Ofcom, the UK online safety regulator, opened proceedings under the Online Safety Act. This relates to the possible dissemination of illegal or harmful content, including AI-generated intimate manipulations.

European Commission: question of systemic risk under the DSA

The European Commission already in January began the next phase of proceedings against X under the Digital Services Act (DSA).

One aspect under review is whether X adequately assessed and mitigated systemic risks before the wider deployment of Grok. The DSA does not focus only on individual posts but on the platform's setup as a whole – that is, whether its design and algorithms enable the scaling of illegal or harmful content.

France: criminal-level investigation

In France a separate criminal investigation is underway regarding potentially illegal content generated via Grok. In February, according to available information, procedural steps were also taken against X's local office.

French authorities are not publicly commenting on the details of the investigation.

What is certain and what is still under investigation

Confirmed:

• The Irish DPC has opened a formal investigation.
• The ICO and Ofcom have opened parallel proceedings in the UK.
• The European Commission continues proceedings against X under the DSA.
• France is conducting its own criminal investigation.

Still unresolved:

• whether a GDPR breach actually occurred,
• whether the outputs were generated on a larger scale,
• whether the platform breached obligations to prevent systemic risks,
• what specific sanctions may follow.

The investigations are at an early stage and none of the regulators has yet issued a final decision.

Context: AI directly inside a social network

The case is significant because it's not an external deepfake tool but an AI feature integrated directly into a global social platform.

This fundamentally changes the regulatory lens – it's not just about content created by an individual, but about the platform's responsibility for the design, testing, and safety restrictions of its AI system.

Further developments will be key not only for X but also for future regulation of generative AI in the European space.