Tilly Norwood is a viral AI-generated character accessible via a video call service that enforces an 18+ age check through a face scan analyzed by a third-party identity verification provider. The service also continuously analyzes callers' facial expressions and voice tone to infer emotional states during calls, which cannot be disabled individually. Calls are recorded and transcribed, with recordings flagged for abusive language by an automated classifier and retained for limited periods. The age verification and mood sensing are justified under legitimate interests, not consent, and apply globally. The service is scheduled to shut down permanently on September 27, 2026. The face scan requirement aligns with UK Online Safety Act regulations for adult content and AI companion chatbots, extending this compliance globally.

The service collects biometric data (video selfies) for age verification and continuously monitors caller emotions during calls, raising privacy concerns. Although the provider states no biometric templates are retained and data is deleted after checks, calls and transcripts are recorded and stored temporarily, with potential human review. The mandatory face scan and mood sensing may impact user privacy and consent expectations. The service's shutdown date limits long-term exposure. There is no indication of exploitation or vulnerabilities in the system.

The vendor states that no biometric templates or images are retained after the age check, and the face scan and mood sensing cannot be disabled per call. Users concerned about privacy should avoid using the service. The service will shut down on September 27, 2026, after which no data collection will occur. There is no indication of a vulnerability or exploit requiring patching or other remediation.