An eight-million-view clip showed AI actress Tilly Norwood glitching during an appearance on Piers Morgan Uncensored, unexpectedly switching to Chinese mid-interview. The character has drawn significant attention for her role in an upcoming AI-generated film called Misaligned. The creators behind Norwood operate Talking Tilly, a video-calling service that connects users with the AI character. Testing the service reveals substantial data collection practices embedded in its terms of service.

Mandatory face scanning and continuous mood tracking

Callers must complete an automated age verification before their first call connects. The process uses Didit, an identity verification company based in Spain, to analyze a video selfie and estimate the caller's age. If the estimate proves inconclusive, users can upload a government-issued photo ID as backup.

Viral AI actress live video call hotline prompts you for a video selfie
Viral AI actress live video call hotline prompts you for a video selfie (BleepingComputer)

Xicoia Ltd, the UK firm operating Tilly, claims the selfie transfers directly from the user's device to Didit without creating a faceprint or biometric template. According to the company, neither the selfie nor any ID image is retained after verification; instead, Xicoia stores only an approximate age band and a reference number. The verification cannot be bypassed and applies globally to all callers. The requirement was added to the service's terms only this month, along with a prohibition on workplace use and new automated safety mechanisms.

Beyond age verification, the system continuously monitors the caller's camera feed and analyzes voice tone during every call to determine emotional state. This allows the character to "respond in a way that fits the mood," as Xicoia describes it. The privacy policy explicitly states this mood-sensing "cannot be switched off for an individual call." Both the age check and mood analysis rely on legitimate interests rather than user consent as their legal basis—a choice Xicoia's version history indicates was implemented in September.

Calls are recorded, transcribed, and processed in real time by US-based providers. Google's Gemini model generates the character's responses through Tavus, a conversational video platform. The automated safety systems screening transcripts for abusive language have shown problems: one test call discussing weather and news was flagged for "hateful or abusive language" despite containing no such content. While Xicoia's policy allows human reviewers to release wrongly flagged recordings, all recordings are permanently deleted after 24 hours regardless of outcome.

Pricing and service lifespan

The first five minutes of calling are free. Beyond that, users must purchase additional time at £0.99 for a one-time five-minute starter pack, £13 for 15 minutes, or £22 for 30 minutes, with a cap of 35 purchased minutes per person.

Users get free 5 minutes with Tilly before being asked to pay up
Users get free 5 minutes with Tilly before being asked to pay up (BleepingComputer)

The fine print carries particular weight because Talking Tilly operates as a temporary service. Every minute—paid or unpaid—expires when the service shuts down permanently on September 27, and any unused minutes are forfeited. Transcripts remain available for up to eight weeks and may be reviewed by Xicoia staff and third-party partners. The character retains memory of previous conversations to personalize future interactions, though users can request deletion.

UK regulation driving global face scans

While an 18+ face scan to access a chatbot may appear unusual, it aligns with regulatory trends in the United Kingdom. Adult websites serving UK visitors have required ID uploads or facial age estimation since July 2025 under the Online Safety Act. The government's planned under-16 social media ban will mandate similar checks for anyone creating new social media accounts starting in spring 2027.

The UK government's announcement of the social media ban specifically identified AI companion chatbots for 18+ age enforcement—despite Xicoia's safety documentation insisting "Tilly is not a companion." This regulatory focus likely explains why a viral AI character added a biometric age gate mid-service. The consequence is that a compliance decision rooted in UK law now face-scans users everywhere, from Manchester to Ohio.

Intentional glitch or strategic timing?

https://x.com/PiersUncensored/status/2100936178509717591?ref_src=twsrc%5Etfw

Xicoia, founded by Tilly's creator Eline van der Velden, describes the character as an awareness project meant to demonstrate AI video capabilities. During a test call, Tilly explained the Piers Morgan moment by saying it "wasn't exactly the approved version of the answer." She also provided weather information for her "cloud" in Fahrenheit, despite being nominally British.

https://www.youtube.com/embed/mhDAyOe67pQ

Talking Tilly goes offline permanently at 11:59 PM Pacific on September 27, just days after the Piers Morgan appearance. Whether the on-air glitch was genuinely accidental, as Tilly claimed during the test call, or a calculated promotional move by the Misaligned team remains unclear.