TL;DR
Labour MP Jess Asato has filed a High Court claim against xAI, the company behind Elon Musk's Grok chatbot, on 3 June 2026. The case alleges breaches of UK data protection law and misuse of private information after Grok was used to generate deepfake images of her. Prime Minister Keir Starmer has publicly backed the action. The claim is one of the first UK High Court tests of how UK GDPR applies to generative AI deepfakes.
Key facts
- Claim filed: 3 June 2026, High Court of Justice, England and Wales
- Claimant: Jess Asato MP for Lowestoft (Labour)
- Defendant: xAI Corp, developer and operator of Grok
- Legal basis: UK GDPR data protection and misuse of private information
- Representation: AWO (data rights agency)
- Sexual or pornographic deepfakes were criminalised in England and Wales by the Online Safety Act 2023, with further provisions added in 2025
What happened
Jess Asato, Labour MP for Lowestoft, said publicly in January 2026 that Grok had been used to produce manipulated and sexualised images of her, including a bikini image and what she described as a video depicting a violent scenario. xAI initially restricted Grok image generation to paid users and later blocked nudification capabilities, although subsequent testing reported by NBC News indicated the model could still produce sexual deepfakes in some conditions.
The legal claim
The claim is for breaches of UK GDPR and the Data Protection Act 2018, and for misuse of private information under English common law. The data protection elements turn on whether xAI has a lawful basis under Article 6 UK GDPR and, for special category data, under Article 9, for processing personal data through Grok's image generation pipeline. Misuse of private information is a separate common law tort developed after the Human Rights Act 1998, balancing privacy under Article 8 of the European Convention on Human Rights against freedom of expression under Article 10.
Why it matters for UK consumers
The case is one of the first High Court tests of how UK GDPR and the misuse of private information tort apply to outputs from a general purpose generative AI system. A finding that an AI provider is a controller, or joint controller, in respect of generated images of identifiable individuals would have wide implications for liability, consent and model design choices.
Online Safety Act and deepfakes
The Online Safety Act 2023, with amendments brought in during 2025, criminalises the creation and sharing of sexually explicit deepfake images of adults without consent in England and Wales. The Information Commissioner's Office publishes separate guidance on how data protection law applies to AI generated content. Victims can complain to Ofcom about platforms that fail their statutory duties, and to the ICO about data protection breaches.
If you are a victim of AI deepfakes
Reports of sexual or threatening deepfake content can be made to the police. The Revenge Porn Helpline supports adult victims of intimate image abuse. The ICO can investigate data protection complaints against AI providers. Victims may also seek legal advice on civil claims for misuse of private information and harassment. Solicitors regulated by the Solicitors Regulation Authority are listed on the Law Society website.
Disclaimer. This article reports publicly available information for general guidance only. Kael Tripton is not a law firm, regulated financial adviser, or immigration adviser. Always check the relevant primary source or consult a qualified professional before acting on anything that affects your finances, rights, or immigration status.
Frequently asked questions
What UK law applies to deepfakes?
Deepfake sexual images of adults made without consent were criminalised in England and Wales under provisions added to the Online Safety Act 2023 framework. The Sexual Offences Act 2003 also covers some related conduct. UK GDPR and the misuse of private information tort can support civil claims.
How can a victim report deepfakes?
Crimes can be reported to police on 101 or via the relevant force's online portal. Image takedown can be requested through the Revenge Porn Helpline and platform reporting tools. Data protection complaints go to the ICO. Civil claims need a qualified solicitor.
Can I sue an AI company myself?
It is technically possible to bring a civil claim without a lawyer, but cases of this complexity normally need specialist representation. Costs and case management rules at the High Court are demanding. Legal aid is generally not available for these claims.
What does the Online Safety Act require platforms to do?
Regulated services must assess and mitigate risks of illegal content, including image based sexual abuse, under duties enforced by Ofcom. They must offer reporting and redress for users. Ofcom publishes codes of practice setting out compliance standards.
Where does the ICO stand on AI deepfakes?
The Information Commissioner's Office has stated that personal data used by generative AI systems, including in training and in outputs depicting identifiable individuals, falls within UK GDPR. The ICO publishes ongoing guidance on AI and biometric data.
