Response to Ofcom update on Grok

Ofcom has today issued an update on its investigation into Grok. In summary, the regulator says that the investigation is proceeding and it will take time; no timescales are given for its completion nor any details of what representations have been made to the regulator by X.

The ICO has also today launched its own investigation, which is a shockingly tardy response to a crisis that is as much about data protection as it is about online safety. The production of synthetic non-consensual intimate images (NCII) of known people clearly raises data protection issues and - unlike in Ofcom’s case - there are no questions about the types of service in scope. Taking three times as long to decide to open an investigation is unjustifiable.

The rest of Ofcom’s press release is a list of all the things it cannot do under the Act or in its enforcement, along with a plea for it to be left alone while it continues its work.

Ofcom says it is still “gathering and analysing evidence to determine whether X has broken the law” and that it “must give any company we investigate a full opportunity to make representations on our case”. "It is important to note", they advise, “that enforcement investigations such as these take time – typically months”.

While “due process” is fundamentally important to the trust and effectiveness of any regulatory regime, such a process has to be proportionate to risk and the speed at which a company chooses to act on the issue that caused the risk; otherwise the interests of a company are put before victims and faith in the process itself is undermined. If a company can act recklessly and precipitously, safe in the knowledge that it will be months or years before anyone can catch up with it, then the regime is undermined.

What is under investigation here is a tool that was rolled out without any consideration of the potential harm that it could cause, at scale, to women and girls on a major social media platform. The functionality has been available since last summer, yet Ofcom failed to pick up the potential risks of its misuse in its oversight of X’s illegal harms risk assessment.

In an 11-day period before Ofcom opened its investigation on 12 January, CCDH has assessed that over 3 million non-consensual “undressed” images of women and children were produced. As of last week, CBS News reported, the tool was still allowing users to generate sexually explicit images without consent; just today Reuters has reported on similar findings that "the Grok chatbot continues to do so when prompted, even after being warned that the subjects were vulnerable or would be humiliated by the pictures".

This is not an ordinary investigation - nor, if Ofcom had been more robust in designing their regulatory framework or carried out more stringent supervision with regard to X’s OSA compliance as soon as its enforcement powers came into effect - is it one that should have waited until harms on such a scale occurred.

Our proposals to strengthen the Online Safety Act in our 10-point Plan - including a requirement on platforms to address all the risks they identify in their risk assessment, to remove the constraint that code of practice measures should be “clear” and “detailed”, and to remove safe harbour - are all the more relevant here.

The repeated assurances from the Ofcom Chief Executive, Dame Melanie Dawes, to successive Parliamentary Committees that the regulator had all the powers it needed to keep users safe online now seem very hollow. We call on the Government to implement our package of proposals immediately.

Ofcom’s update is, however, correct - and uncharacteristically direct - on one crucial thing: “not all chatbots are regulated”. We have been saying that ourselves for months.

It is within the Government’s gift to amend the OSA to fill this gap on chatbot regulation: a proposal on this is also a part of our 10-point Plan. The Secretary of State has said for the past two months that she knows there is a gap and is looking at how to cover it. The regulator is now pleading with her to act. There can be no more time to waste. The Government should use any legislative vehicle at its disposal to amend the OSA without delay.