NewsPublished 19 Sep 2026

Calling viral AI actress Tilly Norwood? Agree to a face scan first

Source Bleeping Computer

Description

The AI actress Tilly Norwood's "Talking Tilly" video call service requires callers to undergo an automated face scan for age verification before connecting. The system uses facial analysis and voice tone detection to infer caller emotions during the call. Calls are recorded, transcribed, and processed by third-party providers, with recordings retained up to 24 hours and transcripts up to eight weeks. The service enforces a strict age gate consistent with UK regulations and permanently shuts down on September 27, 2026. The face scan and mood sensing rely on legitimate interests rather than explicit consent, and the service cannot disable these features per call.

Impact

The service collects biometric data (video selfies) for age verification and continuously monitors caller emotions during calls, raising privacy concerns. Although the provider states no biometric templates are retained and data is deleted after checks, calls and transcripts are recorded and stored temporarily, with potential human review. The mandatory face scan and mood sensing may impact user privacy and consent expectations. The service's shutdown date limits long-term exposure. There is no indication of exploitation or vulnerabilities in the system.

Defensive guidance

The vendor states that no biometric templates or images are retained after the age check, and the face scan and mood sensing cannot be disabled per call. Users concerned about privacy should avoid using the service. The service will shut down on September 27, 2026, after which no data collection will occur. There is no indication of a vulnerability or exploit requiring patching or other remediation.

Summary

Tilly Norwood is a viral AI-generated character accessible via a video call service that enforces an 18+ age check through a face scan analyzed by a third-party identity verification provider. The service also continuously analyzes callers' facial expressions and voice tone to infer emotional states during calls, which cannot be disabled individually. Calls are recorded and transcribed, with recordings flagged for abusive language by an automated classifier and retained for limited periods. The age verification and mood sensing are justified under legitimate interests, not consent, and apply globally. The service is scheduled to shut down permanently on September 27, 2026. The face scan requirement aligns with UK Online Safety Act regulations for adult content and AI companion chatbots, extending this compliance globally.

References

bleepingcomputer.com/news/security/calling-viral-ai-actress-tilly-norwood-agree-to-a-face-scan-first/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Sep 2026, 11:46 UTC

References

Community reviews