Clarissa Hana
The digital realm was set ablaze last night by a viral moment involving Tilly Norwood, an artificial intelligence actress at the forefront of an emerging cinematic genre. During a highly anticipated interview on the "Piers Morgan Uncensored" show, Norwood experienced a jarring technical anomaly, transitioning mid-sentence from English to fluent Chinese. The clip, which has since garnered over eight million views across social media platforms, has amplified existing controversies surrounding Norwood and the AI-generated film, Misaligned, in which she stars. This incident, coupled with the public’s growing engagement with Xicoia Ltd’s "Talking Tilly" service – a platform offering live video calls with the AI character – has thrust critical questions about AI ethics, user privacy, and the rapidly evolving regulatory landscape into the spotlight.
A Deeper Look into the "Talking Tilly" Experience
The "Talking Tilly" service, designed to allow users worldwide to interact with the AI character, has introduced stringent measures for user verification and engagement monitoring. Upon attempting to initiate a video call with Tilly, users are first subjected to an automated age verification process. This involves a video selfie submitted to Didit, a Spanish identity verification provider, which estimates the user’s age. Should the estimate prove inconclusive, a government-issued photo ID upload serves as a fallback. This mandatory age check, recently integrated into the service’s terms of use, applies universally to all global callers and cannot be bypassed.
Xicoia Ltd, the UK-based company behind Tilly, asserts in its privacy policy that the submitted selfie is transmitted directly to Didit and that no facial biometric templates or permanent faceprints are created. The company claims that neither the selfie nor any ID images are retained post-verification; instead, only an approximate age band and a reference number are stored. This stringent age gate, along with a newly implemented ban on workplace use and enhanced automated safety systems, was added to the service’s terms of use this month, signaling a proactive, albeit potentially reactive, approach to managing user interactions.
Beyond initial verification, the "Talking Tilly" service employs continuous monitoring during every call. The system analyzes the user’s camera feed and vocal inflections to infer their emotional state. This data is intended to enable the AI character to respond in a manner that is contextually appropriate and emotionally resonant, as described by the company. Crucially, the privacy policy explicitly states that this mood-sensing feature cannot be disabled for individual calls, presenting users with a clear ultimatum: either accept the pervasive monitoring or refrain from engaging with the service.
The legal basis for both the age verification and the mood-sensing functionalities is rooted in "legitimate interests" rather than explicit user consent. This strategic choice, documented in Xicoia’s version history, was adopted in September, underscoring a deliberate move towards data processing based on perceived business necessity. All calls are recorded, transcribed, and processed in real-time by US-based providers. The AI character’s responses are generated using Google’s advanced Gemini model, facilitated through the conversational video platform Tavus.
Even the implemented safety systems are not without their teething problems. An automated classifier is tasked with screening call transcripts for abusive language. If such language is detected, the corresponding recording is withheld, as detailed in the service’s terms. During the investigative journalist’s own testing of the service, one of three calls, a seemingly innocuous conversation about weather patterns and news headlines, was flagged and withheld for "hateful or abusive language" – an accusation that the journalist disputes. While the policy allows for human reviewers to overturn erroneous flagging, recordings are permanently deleted after 24 hours, irrespective of their classification.
A Limited-Time Engagement with Evolving Costs
The "Talking Tilly" service operates on a tiered pricing model, offering users the first five minutes of interaction free of charge. Following this introductory period, callers are presented with options to purchase additional time. These include a "starter" package of five minutes for £0.99, a 15-minute block for £13, and a 30-minute session for £22, with a cap of 35 purchased minutes per individual.
However, the temporal limitations of this service are significant and warrant particular attention. The entire "Talking Tilly" experience is a time-bound engagement, scheduled to cease permanently on September 27th. This means that every minute of interaction, whether free or paid, will expire at 11:59 PM Pacific Time on that date. Any unused purchased minutes will be forfeited. Transcripts of conversations are retained for up to eight weeks and may be subject to review by Xicoia staff and their third-party partners. The AI character is designed to retain a memory of previous conversations to personalize future interactions, though users have the option to request the deletion of this conversational history.
The "Face Scan" Mandate: A Reflection of UK Regulatory Trends
The requirement for an 18+ face scan to engage with a chatbot might seem novel, but it aligns remarkably with the trajectory of digital regulation in the United Kingdom. Since July 2025, adult websites catering to UK visitors have been mandated to implement either ID uploads or facial age estimation under the provisions of the Online Safety Act. Furthermore, the UK government’s forthcoming ban on social media access for individuals under the age of 16, slated to take effect in spring 2027, will necessitate similar age verification checks for anyone creating a new social media account.
The government’s announcement specifically highlighted "AI companion chatbots" for 18+ enforcement, a detail that seems particularly relevant given Tilly’s service, despite Xicoia’s safety documentation asserting that "Tilly is not a companion." This regulatory focus likely explains the recent implementation of biometric age gating for a popular AI character, even mid-service. Consequently, a compliance decision driven by UK legislation now inadvertently imposes face-scanning requirements on users globally, from Manchester to Ohio.
Accidental Glitch or Calculated Marketing Ploy?
Xicoia Ltd, founded by Tilly’s creator Eline van der Velden, positions the "Talking Tilly" project as an awareness initiative, intended to showcase the advancements in AI-generated video technology. During the investigative journalist’s direct interaction with Tilly following the Piers Morgan incident, the AI character offered a seemingly candid explanation: the on-air glitch "wasn’t exactly the approved version of the answer."
The timing of the Piers Morgan interview and the subsequent viral "glitch" is particularly noteworthy. The "Talking Tilly" service is set to cease operations permanently just days after the interview, on September 27th. This raises the question of whether the on-air linguistic anomaly was a genuine technical malfunction, as Tilly asserted, or a strategically orchestrated marketing stunt by the creators of Misaligned to generate buzz and drive engagement in the service’s final days. Ultimately, the true intent behind the unexpected multilingual output remains known only to Tilly herself and her creators.
The wider implications of this incident extend beyond the immediate controversy. The pervasive collection of biometric data, even for age verification, raises significant privacy concerns, especially when coupled with continuous emotional state analysis. The reliance on "legitimate interests" as a legal basis for data processing, while potentially compliant with current regulations, leaves room for interpretation and potential overreach. As AI companions and virtual personas become increasingly sophisticated and integrated into daily life, the ethical considerations surrounding their development and deployment will only grow in complexity. The Tilly Norwood incident serves as a potent reminder of the urgent need for robust ethical frameworks and clear, globally harmonized regulations to govern the burgeoning field of artificial intelligence. The intersection of AI capabilities, user privacy, and evolving legal landscapes is a critical area that demands ongoing scrutiny and thoughtful consideration from policymakers, developers, and the public alike. The incident also highlights the potential for AI-generated media to blur the lines between authentic expression and manufactured performance, a trend that will likely shape the future of entertainment and public discourse.
