Ofcom launches investigation into X: what happens next?
Ofcom has today announced an investigation into X following what the regulator calls “deeply concerning reports of the Grok AI chatbot account on X being used to create and share undressed images of people – which may amount to intimate image abuse or pornography – and sexualised images of children that may amount to child sexual abuse material (CSAM)”. The full details of the investigation are here.
Our expert legal adviser, Prof Lorna Woods OBE, explains below what might happen next.
The announcement today is the first formal step in enforcing the Online Safety Act (OSA) duties. The Act envisages Ofcom engaging with the regulated service providers: as the timeline graphic in their press notice illustrates, they are now at the stage of analysing the evidence gathered. This will include evidence arising from their contact with X last week to which the platform responded on Friday. Once this information has been analysed - and if Ofcom determines that there has been a compliance failure - the OSA specifies that Ofcom should issue a provisional notice and specify a time within which the service provider should respond and make representations. It is then that Ofcom can issue the final notice of contravention.
Ofcom has flexibility in how long it gives companies to respond, though principles of administrative justice would suggest that providers cannot be given unreasonably short periods of time to respond. In sum, Ofcom has a degree of choice in how fast - or slow - they take the investigation and it is hard to predict how fast that will be. Their press notice and investigation pages have no detail on timescales just that the regulator will “provide an update on this investigation as soon as possible.”
There has been much debate in the media on whether Ofcom can “ban” X - or prevent access to it. Business disruption measures are the mechanisms of last resort; it is clear that the general position is that they should only be used once other measures have proved ineffective.
There is, however, an exception: where there is an ongoing breach and the risks of harm to UK individuals are such that it is appropriate to make an application for a business disruption order without having made either a provisional or confirmation decision. Essentially, in rare circumstances, Ofcom can move straight to applying for a business disruption measure once it has identified a breach of duty and that breach is ongoing. Again, there is little information out there to guide as to the circumstances in which Ofcom might choose this exceptional route.
