If an AI chat app has recently asked for a selfie or a photo of your passport, you are not alone. AI companion age verification has moved from a birthday box to real checks in several countries, and the rules now differ by app and by where you connect from. This page sets out what each major app says in its own help pages and terms, which laws sit behind the prompts, and what happens to your face scan or ID afterwards.
Everything below comes from official app documentation, regulator pages and the text of the law.
Why AI Companion Apps Are Starting to Ask for ID
For years, most companion apps relied on you typing a date of birth. Regulators have now said, in plain terms, that this is not enough for adult content. Three cases show the shift.
United Kingdom
Under the Online Safety Act, services that allow pornography must use age assurance that is "highly effective" at telling whether a user is a child. Ofcom, the regulator, publishes a list of methods it considers capable of meeting that bar: open banking, photo ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services and email-based age estimation. It also states that self-declaring your age, and online payments that don't require you to be 18, are not highly effective. Ofcom adds that pornographic content must not be visible before or during the check.
AI companions are already in Ofcom's sights. On 15 January 2026 it opened an investigation into Novi Ltd, which runs an AI character companion chatbot service, over its compliance with these age check rules. Ofcom can fine a company up to £18 million or 10% of qualifying worldwide revenue, whichever is greater.
Italy
Italy's data protection authority, the Garante, moved against a companion app over age checks early. In February 2023 it ordered Replika to stop processing the data of users in Italy, citing risks to minors. Its later fine, covered in detail below, made age checks a central part of the case.
Brazil
Brazil's ECA Digital (Law 15.211/2025) came into force on 17 March 2026. For products, services or content unsuitable for children and teenagers, including pornographic material, the law requires reliable age verification each time a user accesses them and explicitly bans self-declaration. On 22 September 2026 the Ministry of Justice's digital rights secretariat, Sedigi, published a technical note on 13 AI companion apps. It sent the note to the national data protection authority (ANPD) and the national consumer secretariat (Senacon).
Verification Methods Explained
Not every check asks for the same thing. These are the four you will meet, from least to most invasive.
Self-declared birthday. You type a date or tick a box. It costs you nothing, and it stops nobody who wants to lie. That is why both Ofcom and Brazil's ECA Digital rule it out for adult content.
Face age estimate. You record a short video selfie and software estimates whether you are over a set age. No document is involved. On Janitor AI, the provider k-ID processes the selfie on your device.
Selfie plus ID. You photograph a passport, driving licence or national ID card, and the verifier compares it with a picture of your face. This is the most certain method and also the one that hands over the most personal data. Character.AI and SpicyChat use it as a fallback when a selfie can't confirm your age.
Credit card or billing check. In the UK you must be 18 to get a credit card, so issuers check age before they approve one. Ofcom accepts that a bank approving your card can be taken as evidence you are over 18. Debit cards don't count, because they can be issued to under-18s. Kindroid and SpicyChat both treat a paid subscription as verification.
AI Companion Age Verification by App: Who Checks, and Where
The table covers the four apps that publish a stronger check than a birthday field. It reflects each app's official help pages as of October 2026.
App | Who gets checked | Method | Verifier |
|---|---|---|---|
Character.AI | Accounts its age assurance system flags as under 18 | Selfie first; ID only if the selfie can't confirm 18+ | Persona |
SpicyChat | Users who want NSFW content while connecting from the UK, France, Italy, Australia or listed US states | Video selfie with ID fallback; ID with face match in some regions | Third-party partners |
Janitor AI | Everyone connecting from the UK, Australia or Brazil | On-device face estimate, ID scan, or a reusable AgeKey | k-ID |
Kindroid | Free accounts its behavioural system flags; paid accounts are verified through billing | Selfie estimate or government ID, or start a subscription | Yoti |
Character.AI Selfie Verification
According to Character.AI's help center, the app runs its own age assurance on accounts. If the system decides you are 18 or over, you never see a prompt. If it decides you are under 18, you can accept the under-18 experience or verify. Verification starts with a selfie through Persona, and Persona asks for ID only when it can't confirm your age from the selfie. Character.AI says it never collects or sees your ID, and that Persona deletes biometric information within seven days. Accepted documents include a driver's licence, passport, passport card, identification card and permanent residence card. You can start the process yourself under Settings, then Advanced, then Verify Age.
Does SpicyChat Require ID?
According to SpicyChat's help center, it starts with a video selfie in most regions and offers an ID check if the selfie can't confirm your age. Some regions accept only ID with a face match. The check applies to NSFW content, not the whole site, and SpicyChat decides whether you need it from your current IP address, not your billing details. Covered places are the UK, France, Italy, Australia and a list of US states on its age verification page. If you skip the check, you can still use SpicyChat, but NSFW content, including SFW chats with NSFW-tagged characters, stays locked. If you recently bought a subscription with a credit card, the Verify button is greyed out because you are already verified. Verification is tied to your account, not your device.
Janitor AI Age Verification
Janitor AI's help centre says anyone connecting from an Australian, Brazilian or UK IP address must complete a one-time check to use the site at all. Australia and Brazil went live on 24 April 2026 and the UK on 15 June 2026. Users elsewhere see no change. The check runs through k-ID and offers three routes: a short video selfie processed on your device, a photo of a government ID that is deleted after your age is confirmed, or an AgeKey if you have already verified on another k-ID platform such as Discord or Snapchat. Janitor receives only a yes or no.
Kindroid
According to Kindroid's help center, it splits users into two groups. Paid users are verified through their billing details. Free accounts are checked by a behavioural model, and a flagged account sees only the verification screen until the user subscribes or verifies through Yoti with a selfie or a government ID. The Yoti selfie passes only if you are estimated to be 21 or older, so Kindroid tells 18 to 20 year olds to use ID instead. You can start a Yoti check up to five times in 24 hours, and once verified you won't be asked again.
Nomi AI, Candy AI and Replika
These three are adults-only by their own terms and rely on what you tell them at signup.
- Nomi AI requires an accurate date of birth to create an account. According to its terms of service, it can add age checks at any time and will suspend or terminate any account it suspects belongs to someone under 18. Our Nomi AI review covers the rest of the app.
- Candy AI shows an age gate where you confirm you are over 18, according to its underage policy. Its underage policy states that giving false information about your age breaks its terms. More in our Candy AI review, or see how the two compare in Candy AI vs Nomi AI.
- Replika asks for your birthday at signup, according to its help center. You can correct it within 24 to 48 hours; after that, you have to confirm your age before you can chat with your Replika again. Its privacy policy says it blocks and deletes accounts belonging to under-18s once it finds them.
What Happens to Your ID or Selfie
In every app with a documented check, the app hands the job to a specialist company and gets back a pass or fail. Here is what each one says happens next:
- Persona (Character.AI): biometric information is deleted within seven days, and Character.AI never sees your ID.
- k-ID (Janitor AI): the face estimate runs on your device and nothing is uploaded; ID photos are deleted once your age is confirmed.
- Yoti (Kindroid): your data is encrypted, biometric data is deleted after the check, and Kindroid receives only a pass or fail.
- SpicyChat's partners: SpicyChat says it never sees, receives or stores the images, documents or personal details used, and that partners delete the information under their own privacy standards.
Before you upload anything, read the verifier's own privacy notice. SpicyChat's help centre confirms that the provider's name is shown on the verification screen.
What the Replika Fine and the Brazil Review Mean for Users
The Garante fined Luka Inc., the company behind Replika, €5 million in a decision dated 10 April 2025 and announced in May 2025. It found that, as of 2 February 2023, Replika had no mechanism to check users' ages, either at registration or during use, even though the company said minors were excluded. Technical checks also showed that the age verification system Replika had since put in place was still deficient in several respects. The Garante ordered the company to bring its processing into line with the GDPR and opened a separate inquiry into how the AI model behind Replika was developed and trained.
For users, the lesson is simple: a regulator has now fined a companion app for leaning on a birthday field, and it judged a later fix as still falling short. If the Italian case has put you off Replika, our list of Replika alternatives compares other options.
Brazil's review is at an earlier stage. Sedigi's technical note covered Character.AI, Replika, Nomi AI, Candy.ai, Kindroid, Chai, Paradot, Talkie, CrushOn.AI, EVA AI, Swipey, Anima and SpicyChat.AI. It found that most of them depend only on self-declared age, which the ECA Digital forbids when a service offers content unsuitable for under-18s. The ministry describes the note as preliminary, says it does not prejudge the outcome of any investigation, and confirms that companies will have the right to respond. It is now up to the ANPD and Senacon to act on it.
How to Verify More Safely
If an app asks you to prove your age, these habits cut the risk:
- Start from the app itself. Open verification from the app's own settings, not from a link in an email or chat message.
- Find the verifier's name on the screen and read its privacy notice before you upload.
- Try the face estimate first. It needs no document, and on Janitor AI it runs on your device.
- Use ID only as a fallback, and photograph the physical document, not a screenshot or photocopy.
- Use billing verification if the app offers it and you were going to subscribe anyway, as on Kindroid and SpicyChat.
- Fix the setup before retrying. SpicyChat's help centre lists VPNs and proxies, private browsing, ad blockers and cookie blockers as common causes of failed checks.
- Delete what you no longer need. If you leave an app, delete your account from its settings.
If you're still choosing an app, our best AI girlfriend apps list and the wider AI companion apps hub can help you pick one whose rules suit you.
FAQ
Is AI Chatbot Age Verification Safe?
The documented setups keep your face scan or ID with a separate verifier. Character.AI, Janitor AI, Kindroid and SpicyChat all say they get back only a pass or fail. You are still handing sensitive data to a company, so the on-device face estimate is the lowest-exposure option and an ID upload the highest.
Do AI Girlfriend Apps Check ID in the UK?
Apps that allow pornography must use highly effective age assurance for UK users, and Ofcom says a typed birthday or tick box doesn't qualify. SpicyChat checks UK users before NSFW content, and Janitor AI checks every UK user before they can use the site.
Can I Use a VPN to Avoid Age Verification?
We don't give instructions for this. Here are the terms and legal points. Ofcom says services must not host or allow content that directs or encourages users to get around an age check. App terms are strict: Candy AI says giving false age information breaks its terms, and Nomi AI's terms forbid trying to get around any security feature and allow it to close accounts without a refund. SpicyChat's help centre says a VPN can trigger or break its check, and that once your account is verified it stays verified wherever you connect from. For the legal position on VPNs where you live, check your local law.
Will I Have to Verify More Than Once?
On SpicyChat, Kindroid and Janitor AI, verification is a one-time check tied to your account. SpicyChat says a small number of jurisdictions require periodic re-verification.
What If the Face Scan Says I Look Too Young?
On SpicyChat and Character.AI, you are offered an ID check instead. On Kindroid, the Yoti selfie passes only at an estimated 21 or older, so 18 to 20 year olds should go straight to ID.
Does the App See My Passport?
Character.AI, Janitor AI, Kindroid and SpicyChat all state that they never receive your documents. The verifier handles them and sends back a result.