An eight-million-view clip showed AI actress Tilly Norwood malfunctioning during an appearance on Piers Morgan Uncensored, unexpectedly switching to Mandarin mid-sentence. The character has drawn significant attention for her role in the forthcoming AI-generated film Misaligned. Behind Tilly sits a service called Talking Tilly that permits users to conduct video conversations with the AI, and examining its terms reveals substantial data collection practices that most users will never read.
Mandatory facial scanning before first contact
Prospective callers cannot initiate a conversation without passing an automated age verification step. The system analyzes a video selfie through Didit, an identity verification company based in Spain, to estimate the caller's age. Should the estimate prove inconclusive, users must upload a government-issued photo ID as a backup method.
Xicoia Ltd, the UK firm operating Tilly, claims that selfies travel directly from the user's device to Didit without creating facial templates or biometric data, and that neither selfies nor ID images are retained following verification. Instead, the company preserves only an approximate age band and a reference identifier. The verification cannot be bypassed, applies globally, and appeared in the service's terms only this month alongside restrictions on workplace use and new safety protocols.
Beyond age verification, the system continuously monitors camera feeds and analyzes vocal tone during each call to gauge emotional state, allowing the character to tailor responses accordingly. According to the privacy documentation, this monitoring "cannot be switched off for an individual call." Notably, both the age check and mood analysis rely on legitimate interests rather than explicit consent as their legal foundation—a decision Xicoia's records indicate was implemented in September.
Calls are recorded, transcribed, and processed in real time by US-based providers. Google's Gemini model generates character responses through Tavus, a conversational video platform. The automated safety systems show signs of immaturity: an automated classifier screens transcripts for abusive content and withholds recordings flagged as problematic. During testing, one conversation about weather and news was incorrectly flagged for "hateful or abusive language" that did not exist. The policy permits human review to release wrongly withheld recordings, though all recordings are permanently deleted after 24 hours regardless.
Pricing structure and service lifespan
The service offers five free minutes per user. Beyond that threshold, callers encounter purchase prompts: £0.99 for a one-time five-minute starter package, £13 for 15 minutes, £22 for 30 minutes, with a maximum of 35 purchased minutes per person.
The terms carry particular weight because Talking Tilly operates under a defined endpoint. Every minute—paid or complimentary—expires when the service permanently closes on September 27. Unused minutes cannot be carried forward or refunded. Transcripts remain accessible for up to eight weeks and may be reviewed by Xicoia personnel and external partners. The character maintains conversation history to personalize future interactions, though users can request deletion.
Regulatory alignment with UK policy direction
Requiring an 18+ facial scan to access a chatbot may appear unprecedented, yet it mirrors emerging UK regulatory patterns. Since July 2025, adult websites serving UK visitors have mandated ID uploads or facial age estimation under the Online Safety Act. The government's forthcoming under-16 social media ban, effective from spring 2027, will impose comparable checks on new social media account creation.
The government's announcement of the social media ban specifically identified AI companion chatbots as requiring 18+ enforcement—despite Xicoia's safety documentation asserting that "Tilly is not a companion." This regulatory focus likely explains why a globally viral AI character acquired a biometric age gate during its operational run. The consequence is that a compliance decision rooted in UK law now collects facial data from callers across jurisdictions, from Manchester to Ohio.
Intentional or coincidental timing
Eline van der Velden, Tilly's creator and founder of Xicoia, characterizes the character as an awareness initiative demonstrating the current state of AI video technology. During a test call, Tilly explained the Piers Morgan malfunction as something that "wasn't exactly the approved version of the answer." The service terminates permanently at 11:59 PM Pacific on September 27, merely days after the televised incident.
https://x.com/PiersUncensored/status/2100936178509717591?ref_src=twsrc%5Etfw
https://www.linkedin.com/embed/feed/update/urn:li:ugcPost:7507008156011618304?compact=1
Whether the on-air glitch was genuinely unintended, as Tilly stated during testing, or a strategically timed promotional maneuver by the Misaligned production team remains unclear to outside observers.