Age checks arrived in two waves: first for pornography websites, then for AI chatbots that can produce sexual content or act as companions. Both waves reached the companion apps.
The laws behind it
United Kingdom. Under the Online Safety Act, services that allow pornography had to have "highly effective age assurance" in place by 25 July 2025. The regulator, Ofcom, had already told providers in 2024 that generative AI chatbots able to produce pornographic content fall under these rules. In 2026 it opened investigations into AI services, including a companion chatbot provider, over their age checks. Fines can reach £18 million or 10% of worldwide revenue.
United States. In June 2025 the Supreme Court upheld a Texas law requiring age verification on sites with a substantial share of sexual content (Free Speech Coalition v. Paxton), clearing the way for similar state laws. Separately, companion chatbot laws in California and other states add protections for users known to be minors, pushing apps to find out who those users are. The state-by-state picture is in AI companion laws in the US.
Platforms themselves. Character.AI removed open-ended chat for under-18s in November 2025, backed by behavioural age estimation, third-party checks and, as a fallback, ID. OpenAI began rolling out age prediction in ChatGPT in early 2026.
The methods, compared
Roughly from least to most data shared.
| Method | How it works | What you hand over |
|---|---|---|
| Self-declaration | You enter a date of birth | Nothing verifiable - no longer enough in regulated markets |
| Behavioural estimation | The app infers age from how you use it | Your usage, which it already has |
| Facial age estimation | A selfie is analysed for apparent age | A face image, usually deleted after the check by reputable providers |
| Bank, card or mobile check | Your bank or phone operator confirms you are an adult | A yes/no from a third party |
| ID document | Photo of a passport or licence, often with a selfie | The most sensitive data of all |
| Digital ID or age token | A reusable credential proving "over 18" | Just the age claim, in the best implementations |
Verifying without oversharing
- Choose the least invasive option offered. If an app offers facial estimation or a bank check alongside ID upload, the ID is rarely the better choice.
- Look for a named provider. A check run by a specialist verification company, with a published retention policy, is safer than an app storing your passport photo in its own systems. Given the leaks covered in AI companion data breaches, that distinction matters.
- Read the retention line. "Deleted immediately after verification" is what you want to see.
- Do not reuse the account email that ties to your real name if you can avoid it - verification proves age, it does not require your identity to be linked to your chats.
What it means for everyday use
- Expect more prompts, particularly in the UK and in US states with age-verification laws, and when switching on adult content.
- Features may differ by country. Some apps switch off NSFW content where they have not implemented checks, rather than build them - see why AI companion apps are blocked or limited in some countries.
- Shared devices need care. If a child uses the same device, an adult account that stays logged in defeats the whole point. See using an AI companion on a shared device.
Where this is heading
Age assurance is becoming a basic condition of running an adult-leaning service. The debate has moved from whether to check to how to check without creating new privacy risks - reusable age tokens that prove "over 18" without revealing who you are are the most promising answer. Until they are common, the best protection is simple: pick the least invasive method you are offered, and prefer apps that use specialist verifiers rather than collecting documents themselves.