AI Governance Institute
← News
Corporate Policy2026-09-19

AI Companion Service Pairs Biometric Age Checks With Always-On Emotional Inference

What happened

Xicoia Ltd, the UK company behind a viral AI actress service called Tilly Norwood, requires callers to submit a video selfie processed by Spain-based Didit for automated age verification before any interaction begins, as reported by Bleaching Computer. The company relies on legitimate interests rather than explicit consent as its legal basis for this biometric processing under UK data protection law. During calls, the system infers users' emotional states through continuous camera and voice analysis, a feature the service does not allow users to disable. Xicoia frames this design as a response to the UK Online Safety Act's age-assurance requirements, which compel platforms likely accessed by minors to implement age verification. The arrangement also creates a cross-border biometric data flow from UK users to a Spanish processor, raising transfer-compliance questions that the service's public documentation does not fully address.

Why it matters

  • ·Using legitimate interests as the legal basis for face scanning before a call is contestable under UK GDPR. A supervisory authority challenge could invalidate the age-verification architecture and expose the operator to enforcement, regardless of whether the underlying age-check obligation is genuine.
  • ·Always-on emotional inference that cannot be disabled by users is a significant data-minimization and purpose-limitation problem. Under most data protection frameworks, including UK GDPR, affective computing outputs qualify as inferred sensitive data, and processing them without an opt-out mechanism is difficult to defend.
  • ·Enterprises procuring or deploying AI companion or persona services face a vendor due-diligence gap: this case shows that age-verification compliance in one jurisdiction can embed biometric and affective data practices that create independent liability in others, making third-party intake assessments more complex.

Stay ahead of stories like this

Get every UK AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

DGC-002PII Handling in AI SystemsDGC-005Cross-Border Data Transfer Controls for AISCT-001Anthropomorphic and Companion AI SafeguardsPRC-001AI Vendor Due DiligenceDGC-003Data Minimization for AI Systems

What to do now

  • ☐Audit any AI companion or persona services in your vendor portfolio to determine whether age verification is implemented using biometric processing and what legal basis is documented.
  • ☐Review whether any procured or deployed AI services perform continuous affective inference and confirm that users have a meaningful opt-out mechanism; flag services that do not for escalation.
  • ☐Assess cross-border data flows where biometric data collected in one jurisdiction is processed by a third-party vendor in another, and verify that transfer mechanisms are documented and adequate.
  • ☐Update your third-party AI vendor intake questionnaire to explicitly ask about age-verification methods, the legal basis for biometric processing, and whether emotional inference features can be disabled.
  • ☐Brief your data protection officer on the legitimate-interests-as-basis-for-face-scanning pattern so your organization does not replicate this design in any internally deployed AI service.

What to watch next

The UK Information Commissioner's Office has not yet issued definitive guidance on whether legitimate interests is a permissible basis for biometric age verification under Online Safety Act-mandated schemes, and enforcement posture on affective computing remains unsettled. Compliance teams should monitor ICO outputs under the Regulations Requiring the ICO to Produce a Statutory AI and Automated Decision-Making Code of Practice and watch whether Ofcom's age-assurance standards begin specifying permissible data-processing architectures. The Anthropic age assurance policy covered in Anthropic's Age Assurance Policy Shifts Minor-Access Compliance Onto Deployers is a related signal that minor-access obligations are being pushed down supply chains in ways that force deployers to make consequential data-architecture choices.

Related Coverage

Corporate Policy2026-10-23

Massachusetts $4.3M OpenAI Deal Exposes Resident Data Without Consent Controls

Massachusetts has contracted with OpenAI for roughly $4.3 million per year to deploy an AI assistant across nearly 40,000 executive branch employees. The system processes sensitive resident data, including tax records, housing information, and benefits documentation. No opt-in or opt-out mechanism exists for residents whose data the system may handle.

Corporate Policy2026-10-27

Cloudflare's GLM-5.3 Data Leak Exposes Shared AI Infrastructure Risk

Cloudflare disclosed that its GLM-5.3 model, served through Workers AI, exposed data from one user's session to other users' requests. The flaw arose from how inference session memory was shared across tenants on the same infrastructure. Cloudflare remediated the issue using an updated serving configuration via SGLang.

Corporate Policy2026-10-25

GSA's Anti-Lock-In AI Clause Has an Enforcement Gap Resellers Cannot Close

The U.S. General Services Administration (GSA) has introduced a contract clause requiring AI vendors to support data portability and avoid terms that impede migration. A practitioner commentary argues the clause cannot be enforced against the AI developers who actually control data formats and licensing. Those developers are typically not parties to the government's contract when purchases flow through resellers or systems integrators. The structural gap affects any organization relying on contract language alone to manage AI vendor lock-in risk.