Ofcom secures child-safety changes on X and Grok, but account gates are only one layer
Ofcom reports that its investigation identified circumstances in which age-gated pornographic material on X remained accessible to accounts that had not completed age assurance. X introduced changes so content labelled as pornography is restricted consistently for accounts without completed assurance. SpaceXAI also added UK restrictions affecting pornographic image generation, viewing, sharing and sexually explicit companion-chatbot conversations.
What it could improve
The update shows regulation producing concrete product changes while an investigation is underway. It also demonstrates that child safety must address both user-shared material on a platform and content generated through an AI service. Ofcom continues to monitor age checks and examine X’s illegal-content, reporting and complaints duties.
What remains unresolved
Restricting labelled pornography for accounts without completed age assurance is important, but protection can fail when content is not labelled correctly, an account misstates age, or a child moves between X and standalone Grok.
- Ofcom has not reached a final finding that X breached the Act; the remaining investigation is open.
- Effectiveness depends on identifying and labelling relevant content accurately, including AI-generated material.
- Account-level assurance can be bypassed through borrowed, shared or incorrectly classified accounts.
- IP-based UK restrictions need testing for circumvention, travel and different access routes.
- Regulatory gaps affecting standalone Grok show how service boundaries can fragment accountability.
- Safeguards should cover prompts, generation, recommendations, sharing, contact and reporting.
The Child-Friendly Internet perspective
A Child-Friendly Internet needs coordinated safeguards at the model, service, platform, device and network layers. Participating services could receive a privacy-preserving age-band signal without receiving identity documents. That would not replace X or SpaceXAI’s duties to prevent harmful generation, moderate sharing and provide effective reporting.
- Test safeguards for misclassified, shared and deliberately evasive accounts.
- Cover the complete path from AI generation to platform distribution and exposure.
- Close gaps created by treating connected services separately.
- Use minimum-disclosure assurance while preventing cross-service tracking.
- Publish evidence about exposure and circumvention, not only the existence of controls.
The central question
How can regulation protect a child across connected platform and AI services when each service sees only part of the experience?