*/
Grok around and find out – or not? Mariya Peykova investigates the nudification scandal, what the law has to say about sexually explicit deepfakes, and whether stronger regulation is needed
‘Grok, put her in a bikini and rub her down with baby oil’, ‘Grok, replace her outfit with dental floss’, ‘Grok, have one of them grab her b@@bs from behind and the other one put his hand under her skirt while kissing her.’ These were some of the vile prompts given to Grok, a sophisticated multimodal AI system capable of generating and editing images and text, on the X platform, formerly known as Twitter. The use of Grok sparked controversy in late 2025 and early 2026, as it was used to generate non-consensual sexualised images, with the victims being predominantly women and young girls, some as young as 11.
At the height of the scandal in early 2026, xAI confirmed its plans to disable the functions which enable users to generate sexually explicit deepfakes of real people, but several months after the scandal erupted, reports in the media suggest that the controversial AI tool is still being used to generate such content through the use of various workarounds. In addition, there are several other tools available online which can be used to create sexually explicit deepfakes. In the spring of 2026, criminals downloaded images of children from a school website, and generated child sexual abuse content, which was subsequently used in an attempt to blackmail the school. More troubling still, reports of sextortion affecting children and adolescents have been on the rise. In early June 2026, Labour MP Jess Asato confirmed that she had launched a test case against xAI over demeaning sexualised material created by Grok, including a deepfake video of her being sedated with chloroform. The news has prompted several individuals to come forward and take legal action against the company, reigniting the debate on how liability should be apportioned among the various actors involved, including individuals who use nudification apps, the platforms that host and distribute such tools, and the developers and manufacturers of AI technologies that enable them.
The Online Safety Act 2023 (OSA 2023) introduced a number of new offences into the Sexual Offences Act 2003 (SOA 2003), making it possible to prosecute perpetrators of intimate image abuse. For example, s 66B SOA 2003 makes it a criminal offence for a person to intentionally share or threaten to share a photograph or film which shows or appears to show another person in an intimate state. The offence can be committed even where the perpetrator has no intention to cause distress or alarm to the victim, as long as the victim does not consent to the sharing and the perpetrator does not reasonably believe the victim to have consented.
The offence does not capture the creation of the image or film, only the sharing of it. Theoretically, the sharing of deepfakes or edited images, such as the ones edited through Grok AI or other similar tools, are within the scope of s 66B SOA 2003. This is because s 66A SOA 2003 expressly states that references to ‘photograph or film’ include, among other things, ‘an image, whether made or altered by computer graphics or in any other way, which appears to be a photograph or film’. This would capture an image which has been edited using AI tools.
It is not a defence that the victim has voluntarily uploaded the photograph on a platform such as X, where the original photograph portrays her in clothing, and when a ‘nudifier’ app is then used to remove her clothing. While the Act provides for exemptions in circumstances where the image or film is taken in a public place, where the victim does not have a reasonable expectation of privacy, or where the perpetrator reasonably believes the victim was in the intimate state voluntarily, these do not apply where a ‘nudifier’ app is used to distort the image and sexualise it without consent.
Furthermore, s 138 of the Data (Use and Access) Act 2025 (DUAA 2025) which has been in force since 6 February 2026, introduced a further offence into SOA 2023, that of creating, or requesting the creation of a purported image of an adult. The introduction of the offence by s 138 DUAA 2025 complements the existing framework in SOA 2003 and recognises that harm begins when the deepfake is created, even if it is never shared.
Finally, the Crime and Policing Act 2026 (CPA 2026) introduces a new offence which will be implemented in the SOA 2003, that of making or adapting a ‘thing for use for creating, or facilitating the creation of, child sexual abuse images’. It is notable that ‘thing’ is defined in the Act as including ‘a program, information in electronic form and a service’, meaning that a ‘nudifier’ app or similar AI tool or service would fall within the relevant definition. In simple words, an individual who makes or adapts a program, information in electronic form and/or a service that can be used to generate child sexual abuse content, will be guilty of an offence.
Outside the criminal law, victims of intimate image abuse can also bring a civil claim for misuse of private information, which protects an individual’s right to privacy enshrined in Article 8 of the European Convention of Human Rights. A successful claimant will usually be awarded damages.
For example, in FGX v Stuart Gaunt [2023] EWHC 419 (KB), the claimant issued a claim for misuse of private information against the defendant, who had secretly made recordings of naked images of the claimant and had subsequently uploaded them onto a pornographic website without her consent. The position on deepfakes is still not fully settled, but the law appears to recognise that the image itself does not need to be ‘real’ to found a cause of action in misuse of private information, as long as the victim has a reasonable expectation of privacy in the image or film and it is ‘used’ in some way, such as where it is shared with the public, for example.
In the case of McKennitt and Ors v Ash [2006] EWCA Civ 1714 the court made it clear that ‘[t]he question in a case of misuse of private information is whether the information is private, not whether it is true or false.’ A host of other civil causes of action are possible against individual perpetrators, such as claims in defamation, malicious falsehood, copyright, passing off, civil harassment, breach of contract claims, and even data protection claims where the data is not being processed in the context of a purely personal or household activity.
As a user-to-user service with ties to the United Kingdom, xAI and other platforms of its kind are regulated under OSA 2023. Ofcom has opened a formal investigation into whether the company failed to comply with its legal and regulatory obligations. While legal responsibility to decide whether content hosted on online platforms complies with the law lies with the platforms themselves, Ofcom has certain enforcement powers and can impose relatively hefty fines in cases of non-compliance, as well as to make an application to court for service restriction orders. Ofcom’s enforcement powers in this context are relatively new, but the regulator made a strong start at the end of 2025 by imposing AVS Group Ltd (an operator of 18 adult websites) with a £1 million fine for its failure to implement highly effective age verification checks on its website.
Furthermore, in their capacity as data controllers, platforms such as xAI have several obligations under data protection legislation, such as a duty to process personal data lawfully, fairly and transparently, and can be subject to the ICO’s regulatory enforcement powers, which include issuing enforcement notices and fines. In February 2026, the ICO opened a formal investigation into xAI looking into whether the tech giant has complied with its regulatory obligations. The central question appears to be whether adequate safeguards were incorporated into Grok’s design and deployment.
It remains to be seen whether the ongoing investigations will result in enforcement action, and whether any such action will have a meaningful impact on what is a very influential, multi-billion-dollar company.
The law is gradually adapting to recent technological advancements. The changes introduced by OSA 2023 have reshaped the legal landscape by creating new offences relating to the creation and dissemination of sexually explicit deepfakes, while also granting regulators additional powers to hold platforms accountable. However, many have argued that a more fundamental issue has been whether companies that design and manufacture AI technologies should be permitted to release tools capable of generating sexually explicit deepfakes to consumers in the first place.
In December 2025, the government announced its intention to ban ‘nudification’ apps. In a letter addressed to the Science, Innovation and Technology Committee’s Chair Dame Chi Onwurah in January 2026, the Secretary of State for Science, Innovation and Technology confirmed the government’s commitment in this respect, notably by committing to introduce new offences through the CPA 2026. Many argued that the government had not yet formulated a sufficiently clear position on whether companies that design and manufacture AI technologies which can be used to create sexually explicit deepfakes should be prohibited from placing such products on the market.
While there was an emerging expectation that AI developers would be held liable for failures to incorporate efficient safeguards into the design and deployment of their systems, it remains clear that there was some hesitation in embracing a model of direct developer liability. In May 2026, the EU Parliament and Council agreed to ban AI systems that create sexual content without the relevant person’s consent. These prohibitions will apply to existing restrictions on placing certain AI tools on the EU market. This is a decisive step towards banning ‘nudification’ apps, not merely by criminalising their creation or use by individuals, but also by prohibiting their developers from placing them on the market in the first place.
As of 29 June 2026, s 66I SOA 2003 makes it a criminal offence to ‘make or adapt a thing, or supply or offer to supply a thing for use as a generator of purported intimate images’. Under s 66L, this offence also applies to relevant bodies, such as companies and unincorporated associations.
Do we need better rules, or do we just need to do better?
Behind every legal rule or legislative instrument lies a moral question, often surrounding responsibility and fairness. The existing legal framework allocates responsibility at the platform and user level, and more recently, new offences have been implemented which aim to fill the previous gap in relation to those who develop AI tools. While we might have taken some decisive steps towards better rules that address responsibility at all levels, law is not a panacea. A more comprehensive regulatory and criminal framework will not be sufficient if societal attitudes continue to normalise violence in intimate relationships, trivialise misogyny, and continue to uphold a persistent lack of care for those who are most vulnerable in society.
Note: This is an updated version of the article published in the July 2026 print issue of Counsel and reflects the introduction of ss 66I-66L to the SOA 2003 on 29 June 2026 by the CPA 2026.
Pictured top: A protest in Times Square, New York City, 11 June 2026, against Elon Musk’s gen AI tool Grok, which has been widely used to create non-consensual sexualised images of undressed women and children.
Mariya Peykova is a barrister at 3PB. Her particular focus is on commercial and regulatory law in matters raising complex contractual interpretation points, as well as a range of data protection and privacy issues, and education law. In 2024, Mariya was nominated for the ‘Junior Pro Bono Barrister of the Year’ award. Before coming to the Bar, she worked as a Research Fellow at Queen Mary University and a Judicial Assistant at the Court of Appeal and High Court.
‘Grok, put her in a bikini and rub her down with baby oil’, ‘Grok, replace her outfit with dental floss’, ‘Grok, have one of them grab her b@@bs from behind and the other one put his hand under her skirt while kissing her.’ These were some of the vile prompts given to Grok, a sophisticated multimodal AI system capable of generating and editing images and text, on the X platform, formerly known as Twitter. The use of Grok sparked controversy in late 2025 and early 2026, as it was used to generate non-consensual sexualised images, with the victims being predominantly women and young girls, some as young as 11.
At the height of the scandal in early 2026, xAI confirmed its plans to disable the functions which enable users to generate sexually explicit deepfakes of real people, but several months after the scandal erupted, reports in the media suggest that the controversial AI tool is still being used to generate such content through the use of various workarounds. In addition, there are several other tools available online which can be used to create sexually explicit deepfakes. In the spring of 2026, criminals downloaded images of children from a school website, and generated child sexual abuse content, which was subsequently used in an attempt to blackmail the school. More troubling still, reports of sextortion affecting children and adolescents have been on the rise. In early June 2026, Labour MP Jess Asato confirmed that she had launched a test case against xAI over demeaning sexualised material created by Grok, including a deepfake video of her being sedated with chloroform. The news has prompted several individuals to come forward and take legal action against the company, reigniting the debate on how liability should be apportioned among the various actors involved, including individuals who use nudification apps, the platforms that host and distribute such tools, and the developers and manufacturers of AI technologies that enable them.
The Online Safety Act 2023 (OSA 2023) introduced a number of new offences into the Sexual Offences Act 2003 (SOA 2003), making it possible to prosecute perpetrators of intimate image abuse. For example, s 66B SOA 2003 makes it a criminal offence for a person to intentionally share or threaten to share a photograph or film which shows or appears to show another person in an intimate state. The offence can be committed even where the perpetrator has no intention to cause distress or alarm to the victim, as long as the victim does not consent to the sharing and the perpetrator does not reasonably believe the victim to have consented.
The offence does not capture the creation of the image or film, only the sharing of it. Theoretically, the sharing of deepfakes or edited images, such as the ones edited through Grok AI or other similar tools, are within the scope of s 66B SOA 2003. This is because s 66A SOA 2003 expressly states that references to ‘photograph or film’ include, among other things, ‘an image, whether made or altered by computer graphics or in any other way, which appears to be a photograph or film’. This would capture an image which has been edited using AI tools.
It is not a defence that the victim has voluntarily uploaded the photograph on a platform such as X, where the original photograph portrays her in clothing, and when a ‘nudifier’ app is then used to remove her clothing. While the Act provides for exemptions in circumstances where the image or film is taken in a public place, where the victim does not have a reasonable expectation of privacy, or where the perpetrator reasonably believes the victim was in the intimate state voluntarily, these do not apply where a ‘nudifier’ app is used to distort the image and sexualise it without consent.
Furthermore, s 138 of the Data (Use and Access) Act 2025 (DUAA 2025) which has been in force since 6 February 2026, introduced a further offence into SOA 2023, that of creating, or requesting the creation of a purported image of an adult. The introduction of the offence by s 138 DUAA 2025 complements the existing framework in SOA 2003 and recognises that harm begins when the deepfake is created, even if it is never shared.
Finally, the Crime and Policing Act 2026 (CPA 2026) introduces a new offence which will be implemented in the SOA 2003, that of making or adapting a ‘thing for use for creating, or facilitating the creation of, child sexual abuse images’. It is notable that ‘thing’ is defined in the Act as including ‘a program, information in electronic form and a service’, meaning that a ‘nudifier’ app or similar AI tool or service would fall within the relevant definition. In simple words, an individual who makes or adapts a program, information in electronic form and/or a service that can be used to generate child sexual abuse content, will be guilty of an offence.
Outside the criminal law, victims of intimate image abuse can also bring a civil claim for misuse of private information, which protects an individual’s right to privacy enshrined in Article 8 of the European Convention of Human Rights. A successful claimant will usually be awarded damages.
For example, in FGX v Stuart Gaunt [2023] EWHC 419 (KB), the claimant issued a claim for misuse of private information against the defendant, who had secretly made recordings of naked images of the claimant and had subsequently uploaded them onto a pornographic website without her consent. The position on deepfakes is still not fully settled, but the law appears to recognise that the image itself does not need to be ‘real’ to found a cause of action in misuse of private information, as long as the victim has a reasonable expectation of privacy in the image or film and it is ‘used’ in some way, such as where it is shared with the public, for example.
In the case of McKennitt and Ors v Ash [2006] EWCA Civ 1714 the court made it clear that ‘[t]he question in a case of misuse of private information is whether the information is private, not whether it is true or false.’ A host of other civil causes of action are possible against individual perpetrators, such as claims in defamation, malicious falsehood, copyright, passing off, civil harassment, breach of contract claims, and even data protection claims where the data is not being processed in the context of a purely personal or household activity.
As a user-to-user service with ties to the United Kingdom, xAI and other platforms of its kind are regulated under OSA 2023. Ofcom has opened a formal investigation into whether the company failed to comply with its legal and regulatory obligations. While legal responsibility to decide whether content hosted on online platforms complies with the law lies with the platforms themselves, Ofcom has certain enforcement powers and can impose relatively hefty fines in cases of non-compliance, as well as to make an application to court for service restriction orders. Ofcom’s enforcement powers in this context are relatively new, but the regulator made a strong start at the end of 2025 by imposing AVS Group Ltd (an operator of 18 adult websites) with a £1 million fine for its failure to implement highly effective age verification checks on its website.
Furthermore, in their capacity as data controllers, platforms such as xAI have several obligations under data protection legislation, such as a duty to process personal data lawfully, fairly and transparently, and can be subject to the ICO’s regulatory enforcement powers, which include issuing enforcement notices and fines. In February 2026, the ICO opened a formal investigation into xAI looking into whether the tech giant has complied with its regulatory obligations. The central question appears to be whether adequate safeguards were incorporated into Grok’s design and deployment.
It remains to be seen whether the ongoing investigations will result in enforcement action, and whether any such action will have a meaningful impact on what is a very influential, multi-billion-dollar company.
The law is gradually adapting to recent technological advancements. The changes introduced by OSA 2023 have reshaped the legal landscape by creating new offences relating to the creation and dissemination of sexually explicit deepfakes, while also granting regulators additional powers to hold platforms accountable. However, many have argued that a more fundamental issue has been whether companies that design and manufacture AI technologies should be permitted to release tools capable of generating sexually explicit deepfakes to consumers in the first place.
In December 2025, the government announced its intention to ban ‘nudification’ apps. In a letter addressed to the Science, Innovation and Technology Committee’s Chair Dame Chi Onwurah in January 2026, the Secretary of State for Science, Innovation and Technology confirmed the government’s commitment in this respect, notably by committing to introduce new offences through the CPA 2026. Many argued that the government had not yet formulated a sufficiently clear position on whether companies that design and manufacture AI technologies which can be used to create sexually explicit deepfakes should be prohibited from placing such products on the market.
While there was an emerging expectation that AI developers would be held liable for failures to incorporate efficient safeguards into the design and deployment of their systems, it remains clear that there was some hesitation in embracing a model of direct developer liability. In May 2026, the EU Parliament and Council agreed to ban AI systems that create sexual content without the relevant person’s consent. These prohibitions will apply to existing restrictions on placing certain AI tools on the EU market. This is a decisive step towards banning ‘nudification’ apps, not merely by criminalising their creation or use by individuals, but also by prohibiting their developers from placing them on the market in the first place.
As of 29 June 2026, s 66I SOA 2003 makes it a criminal offence to ‘make or adapt a thing, or supply or offer to supply a thing for use as a generator of purported intimate images’. Under s 66L, this offence also applies to relevant bodies, such as companies and unincorporated associations.
Do we need better rules, or do we just need to do better?
Behind every legal rule or legislative instrument lies a moral question, often surrounding responsibility and fairness. The existing legal framework allocates responsibility at the platform and user level, and more recently, new offences have been implemented which aim to fill the previous gap in relation to those who develop AI tools. While we might have taken some decisive steps towards better rules that address responsibility at all levels, law is not a panacea. A more comprehensive regulatory and criminal framework will not be sufficient if societal attitudes continue to normalise violence in intimate relationships, trivialise misogyny, and continue to uphold a persistent lack of care for those who are most vulnerable in society.
Note: This is an updated version of the article published in the July 2026 print issue of Counsel and reflects the introduction of ss 66I-66L to the SOA 2003 on 29 June 2026 by the CPA 2026.
Pictured top: A protest in Times Square, New York City, 11 June 2026, against Elon Musk’s gen AI tool Grok, which has been widely used to create non-consensual sexualised images of undressed women and children.
Grok around and find out – or not? Mariya Peykova investigates the nudification scandal, what the law has to say about sexually explicit deepfakes, and whether stronger regulation is needed
The age of criminal responsibility, extreme weather and conflict resolution – plus, new protocol for reporting bullying at the Bar
By David Green
Mário Barroso, Head of R&D and Method Development at AlphaBiolabs, examines the forensic science underpinning hair drug testing, its evidential scope and limitations, and why it remains the gold standard for evidencing patterns of drug use in family proceedings
Unlocking your aged debt to fund your tax in one easy step. By Philip N Bristow
Clement Cowley, Partner at The Penny Group, discusses the upcoming changes to pensions and Inheritance Tax and the potential impact on your financial future
Save the Children UK is the latest charity to benefit from a £500 donation from AlphaBiolabs via the company’s Giving Back initiative
Can reflective practice – a staple in other professions – meaningfully support the Bar? Emma Cross reports back from last year’s pilot
Does your constitution comply? The Harman Report provides impetus to update yours – and the sooner the better. Scott Leonard explains how
A decade of reviews and research has disrupted accepted thinking in the search for causality. Suicides following abuse have overtaken domestic homicides. Is the law keeping up? Professor Susan Edwards KC (Hon) examines recent cases and the obstacles to successful prosecution
Why every major sporting event needs an anti-corruption policy. By Louis Weston
At least not that way, says Richard Paige
