Ofcom: X Fails Illegal-Content Test Despite Faster Reviews

By Daniel Rao

X did what it was asked to do. It reviewed suspected illegal hate and terror content faster, filed its first quarterly report, and landed inside the timeframes it had agreed with Britain's media regulator. And on Wednesday, Ofcom's response was, in effect: that was never the whole test.

The regulator's update, published on 14 October, is a study in polite dissatisfaction. Yes, X is quicker. But Ofcom says it still has "ongoing concerns around the effectiveness of X's response to taking down illegal hate and terror content." Speed, in other words, is not the same as safety — and nine months into one of the most politically charged investigations in the Online Safety Act's short life, the gap between the two is the whole story.

We read Ofcom's full update ourselves, along with its original investigation notice and the May commitments that set this process in motion. What emerges is a regulator that has learned to be precise about what it can prove, patient about what it cannot yet prove, and quietly furious about what keeps slipping through the cracks.

Faster reviews, same hard question

The headline fact of Wednesday's update is straightforward. X has submitted its first quarterly report to Ofcom on the action it takes when users report suspected hate and terror content. Compared with the evidence Ofcom examined earlier this year, the data "appears to show some improvements in the average time it takes X to act on these reports, and its performance falls within the agreed response timeframes under its commitments."

That is a real concession from a regulator that has rarely handed X a compliment. But Ofcom immediately hedged it in two directions. First, it will cross-check X's performance metrics against its own tests — it is not taking the company's numbers on trust. Second, it told X that it must, "as a minimum, sustain this performance." Read the update twice and the shift in tone is hard to miss: Ofcom writes like a regulator, which is to say it buries its punches in subordinate clauses, but this one is barely buried at all. The message is that a good quarter is a floor, not a pass.

The deeper problem is the one Ofcom names outright. Reviewing content quickly and removing it effectively are different jobs. A report can be assessed on time and still end with the wrong decision, or with a decision that never quite turns into a takedown. Ofcom says it has also "received mixed reports around the sustained delivery of X's commitment to engage with third-party experts" — the civil-society groups that first told the regulator that their flags of suspected illegal content seemed to vanish into a void. If the people whose job is spotting this material cannot tell whether they are being heard, the machinery is still broken, whatever the stopwatch says.

Ofcom expects to publish a further analysis of X's performance in its next update early in the new year, once it has received more data. That is the rhythm of this case now: quarterly homework, marked in public.

What X actually promised in May

To understand why Wednesday's update reads the way it does, rewind to May. After intensive engagement with Ofcom, X made three public commitments. The first was speed: it would review and assess suspected illegal terrorist and hate content reported through its dedicated UK illegal content reporting tool within an average of 24 hours, measured as a mean over three months, with a backstop of assessing at least 85% within 48 hours. The second was engagement: it would work with third-party experts on its reporting systems, after organisations told Ofcom they had flagged suspected illegal hate and terrorism content to X but were unsure whether their reports were even being received or actioned. The third was accounts: X would withhold UK access to accounts reported for posting UK illegal terrorist content if it determined they were operated by or on behalf of a terrorist organisation proscribed in the UK.

Alongside those promises came quarterly performance data to Ofcom for twelve months, so the regulator could monitor delivery rather than take assurances at face value.

At the time, Oliver Griffiths, Ofcom's Online Safety Group Director, said the commitments were "a step forward, but there's a lot more to do." He added that Ofcom had evidence that terrorist content and illegal hate speech was persisting on some of the largest social media sites, and that the issue mattered all the more "following a number of recent hate motivated crimes suffered by the country's Jewish community." Danny Stone, Chief Executive of the Antisemitism Policy Trust, was blunter: X was "failing in so many regards to tackle open racism on its platform," and he hoped Ofcom would "hold X to account for what it has promised the regulator it will do."

That is the yardstick Wednesday's update applies. On speed, X has met the number. On the rest — the expert engagement, the actual removal outcomes — Ofcom is not yet convinced.

Photo: Riverside House, Bankside — home of Ofcom's offices. Credit: Jim Linwood, CC BY 2.0, via Wikimedia Commons.

The investigation narrows — and the porn loophole closes

Wednesday's update also reframes the formal investigation that has hung over X since January. Ofcom opened it on 12 January 2026 after deeply concerning reports that the Grok chatbot account on X was being used to create and share undressed images of people, and sexualised images of children. The regulator contacted X on 5 January and gave it until 9 January to explain what it had done to meet its duties. X responded by the deadline; Ofcom opened the formal probe anyway.

Since then, investigators have gathered and analysed what Ofcom calls "an extensive amount of information" using its formal powers, examining how X assessed the risk of illegal content appearing on the platform, how easy it is for users to report suspected illegal content, and how it approached the moderation decisions that followed those reports.

One piece of that evidence-gathering produced an unexpected finding with nothing to do with Grok. Ofcom discovered that, in certain circumstances, age-gated pornographic material remained accessible on X to accounts that had not been verified as belonging to users aged 18 or over. In response to the regulator's concerns, X implemented a series of changes, and content labelled as pornography is now consistently restricted for accounts that have not completed age assurance through X's designated methods.

That fix is why Ofcom has decided to focus the remainder of the investigation on X's compliance with its illegal content and complaints and reporting duties — while continuing to monitor whether the age checks actually work. Narrowing an investigation is not the same as ending it. It is the regulator saying: this part is fixed, or fixed enough to watch rather than litigate. The rest is still live.

Grok's new UK restrictions, and the gap they leave

The Grok half of Wednesday's update is where the story gets both more concrete and more frustrating. After engagement with Ofcom, SpaceXAI — the company formerly known as xAI — has imposed further restrictions on the standalone Grok service. People with UK IP addresses are now restricted from viewing, generating and/or sharing pornographic content using the image generation technology provided by standalone Grok, in the app or via links. Its companion chatbots, including "Ani", have been restricted to prevent them from engaging in sexually explicit conversations with UK users.

These are the second round of restrictions. The first came in January, when SpaceXAI moved to block people from using the service to generate or view images of real people in revealing attire, such as bikinis, after the initial wave of reports.

Here is the catch, and Ofcom states it plainly. When it opened the investigation in January, it was clear that it was unable to investigate the creation of illegal images within the standalone Grok service, "because of gaps in the way chatbots are covered under the Act." That gap has not closed. The restrictions on standalone Grok exist because Ofcom asked for them and the company agreed — not because the regulator could compel them through this investigation. Ofcom says it will keep monitoring how the restrictions are applied and keep engaging with SpaceXAI about the wider application of the Act to the standalone Grok service. That is regulation by persuasion, and everyone involved knows it.

The stakes behind that persuasion are not abstract. Reuters found that Grok was still generating sexualised images of people when prompted, even where users explicitly said the subjects had not consented. And the original January investigation was triggered by reports of demeaning sexual deepfakes of real people, including children — material that may amount to illegal content under UK law, including intimate image abuse and child sexual abuse material. X did not immediately respond to a request for comment on Wednesday's update.

It is worth keeping the regulators straight here, because this story has two of them. The Grok affair also drew in the Information Commissioner's Office, the UK's data protection watchdog — a separate body from Ofcom, which handles online safety. We covered the ICO's own move earlier this month, when it got ten AI giants to pledge a data cleanup. Wednesday's update is Ofcom's, under the Online Safety Act, and it is a different kind of action with different teeth.

What happens next: the provisional view

Ofcom's next step is the one that matters most. The investigation will now determine whether, on the evidence gathered, X has complied with its duties to protect people in the UK from illegal content. If the regulator has reasonable grounds to believe X has failed to meet its duties, it will issue a provisional view to X, setting out the reasons for its proposed findings. X would then have a full opportunity to respond before Ofcom makes a final decision.

A provisional view is not a verdict, but it is the closest thing to one in this process — the moment Ofcom puts its conclusions in writing and dares the company to answer them. Until then, the investigation's formal status is unchanged: open, narrowed, and pointed at the question of whether X's systems actually deliver what the law requires.

If Ofcom eventually finds a breach, the consequences are serious. Under the Online Safety Act, it can fine a company up to £18 million or 10% of its qualifying worldwide revenue, whichever is greater. In the most severe cases, it can seek a court order for business disruption measures, including asking internet providers to block access to a service in the UK. Nobody is suggesting a block on X is imminent — it is the last resort in the regulator's toolkit, not the next step. But the fact that it exists in the toolkit at all is part of why this investigation is watched so closely.

Photo: The Palace of Westminster, where Parliament passed the Online Safety Act in 2023. File photo from 2007. Credit: Diliff, CC BY-SA 2.5, via Wikimedia Commons.

The Washington problem

None of this happens in a vacuum, and the vacuum is the problem. The Trump administration has forcefully opposed the EU's Digital Services Act and Britain's Online Safety Act, which Washington says stifle free speech and impose burdensome requirements on US tech companies. Earlier this year, Under Secretary of State for Public Diplomacy Sarah Rogers led a push to fund free-speech initiatives in allied Western countries — a campaign aimed squarely at laws like Britain's.

This week the tension acquired a legislative form. According to The Times, allies of President Trump have backed a bill, filed by Republican congressman Michael Rulli and known as the Granite Act, that would bar US courts from recognising or enforcing foreign fines related to online speech — effectively blocking British regulators from enforcing online safety rules on US-based websites. Rulli told The Times: "Foreign bureaucrats do not get to decide what Americans can say." The Times reported the bill is understood to be supported by senior members of the Trump administration.

Ofcom has already shown it is willing to fine an American platform: The Times reported it fined the US messaging site 4chan £520,000 in March after finding it failed to put in age checks to prevent children seeing pornography. Whether a US court would ever enforce a British fine against X is a question for a very different kind of courtroom — but it is now an open question in Congress, not just a hypothetical.

The irony is that Britain's political class has been anything but shy about this fight. Back in January, Prime Minister Keir Starmer called the Grok material "disgraceful" and "disgusting", told X it had "got to get a grip of this", and said all options were on the table. A Downing Street spokesman later called X's move to limit Grok image editing to paying subscribers "not a solution" and "insulting" to victims. London and Washington are not just disagreeing about a statute. They are disagreeing about whether the statute is legitimate at all.

Our view: speed is not safety

Here is where we plant our flag. Ofcom's update is being read in some quarters as a soft landing for X — faster reviews, a narrowed investigation, a pat on the head for the porn fix. That reading is wrong, and it misses what the regulator is actually doing.

Ofcom is building a paper trail. Quarterly reports, cross-checked metrics, documented expert engagement, a formal narrowing that proves it can tell a fixed problem from an open one: this is what enforcement looks like when the target is a company with bottomless legal resources and a political patron in the White House. A regulator that rushed to a breach finding would hand X a judicial review on a plate. A regulator that documents every step makes its eventual findings very hard to overturn.

But there is a harder truth on the other side. A moderation regime that reviews quickly and removes shoddily is not a moderation regime at all — it is a triage desk with good paperwork. The original sin of the Grok affair was not slow paperwork; it was a product that let users turn real people's photos into sexualised images, including images of children, at scale, before anyone with power over it acted. No quarterly report undoes that. And the chatbot gap Ofcom openly admits — that it cannot investigate image creation inside the standalone Grok service — is a colossal hole in the law that Parliament will have to close, because persuasion is not a substitute for jurisdiction.

X's defenders will say the company has moved further and faster than any of its peers, and on the narrow evidence of Wednesday's update, the speed claim is fair. But speed was the easy promise. The hard one — that illegal content actually comes down, and stays down — is the one Ofcom says it still doubts. Until that doubt is resolved, with evidence rather than assurances, this investigation is not winding down. It is winding up.

We checked TechPulse USA's own archive while reporting this story: our earlier coverage of Musk folding Grok into X's premium tiers and of Europe's tech chief pushing back on Washington over rogue AI rules both point at the same underlying fight — who gets to set the rules for American platforms operating in other people's countries. Wednesday's update is the latest, and most procedural, round of that fight. The next round will be Ofcom's provisional view, and X will get a full chance to respond before any final decision.

Sources

Ofcom, "Monitoring X's response to hate and terror content, and Grok investigation latest" (14 October 2026) and "Statement on X's commitment to bring in new protections to tackle illegal hate and terror content" (May 2026); Ofcom, "Ofcom launches investigation into X over Grok sexualised imagery" (12 January 2026); Reuters / CNA (14 October 2026); The Times (13 October 2026); House of Commons Library briefing on the Online Safety Act; Roch Valley Radio and Xinhua on Prime Minister Starmer's January 2026 remarks; Anadolu Agency on the ICO's separate Grok probe. X did not immediately respond to a request for comment.

Daniel Rao covers AI regulation and platform accountability for TechPulse USA. He has reported on the Online Safety Act since it came into force, and he reads regulators' updates so you don't have to — though on this one, the update was worth reading.

Ofcom X investigation FAQ

What did Ofcom decide about X on 14 October 2026? X met its speed commitments: it reviewed suspected illegal hate and terror content within the agreed timeframes and filed its first quarterly report. But Ofcom said it still has ongoing concerns about how effectively X actually takes illegal content down, and it narrowed the formal investigation to X's illegal-content and complaints-and-reporting duties, keeping the age-check fix under monitoring.

What is an Ofcom provisional view? It is the regulator's written set of proposed findings, issued when it has reasonable grounds to believe a company failed its duties. X would then have a full opportunity to respond before Ofcom makes a final decision. A provisional view is not a verdict — but it is the closest thing to one in this process.

How large a fine could Ofcom impose on X? Up to £18 million or 10% of the company's qualifying worldwide revenue, whichever is greater. In the most severe cases Ofcom can seek a court order for business disruption measures, including asking internet providers to block access to a service in the UK. A block is the last resort, not the next step.

Why can't Ofcom investigate image creation inside the standalone Grok service? Because of gaps in the way chatbots are covered under the Online Safety Act. The UK restrictions on standalone Grok exist because Ofcom asked for them and the company agreed — not because the regulator could compel them through this investigation.

What did X promise Ofcom in May 2026? Three things: review suspected illegal terrorist and hate content reported through its UK tool within an average of 24 hours, with at least 85% assessed within 48 hours; engage with third-party experts on its reporting systems; and withhold UK access to accounts reported for posting UK illegal terrorist content if they were run by or for a UK-proscribed terrorist organisation — plus quarterly performance data to Ofcom for twelve months.

The parallel fight: platforms challenge Ofcom's data demands

One piece of context sits just outside this investigation. In the week before Ofcom's update, Meta, TikTok and X challenged the volume of operational data Ofcom demands from platforms under the new regime, arguing the requests were burdensome; Ofcom says the data is needed to judge whether the regime is working. That dispute matters to the X case: the quarterly reports and cross-checked metrics at the heart of Ofcom's update are exactly the kind of disclosure the platforms are resisting. (Background verified this run from Reuters reporting; it predates the 14 October update and is not a new development in the X investigation.)