Talking Tilly, the video calling service from viral AI actress Tilly Norwood, is sparking a new debate about the limits of privacy. Before the first call, the system checks the user's age with a selfie, while during the conversation it analyzes the user's image and voice to assess their mood, according to BleepingComputer.
The service is aimed exclusively at adults and requires a mandatory verification before first contact. The Xicoia company's privacy policy states that verification is provided by Didit: the user takes a selfie and the service estimates whether they are over 18. If the result is unclear, a photo of a government document is requested.
See also: Flock cameras: Texas freezes funding for AI-powered surveillance
How control works in Talking Tilly
According to the official privacy policy, the selfie and any ID image are transmitted directly to Didit and do not remain with Xicoia. The company states that no facial recognition or other biometric template is created and that the images are deleted after verification.
What is retained is the result, the method used, an approximate age range, the date, and a reference number. Talking Tilly does not allow bypassing the verification. Those who fail verification cannot use the service, and the policy provides for a human review in case of an error.
Mood analysis is not turned off
The most sensitive element is inside the call. The platform examines live camera footage, tone of voice, objects around the user, and whether they are looking at the screen. From these, it tries to assess the emotional state so that the digital actress can adjust her responses.
In Talking Tilly, the company clarifies that this process is not used for identity recognition, does not create a facial or voice fingerprint, and does not store the results, except for security-related decisions. However, mood analysis cannot be disabled for a specific call; the user can only end the conversation.
Calls are recorded in video and audio, and a transcript is also created. The policy states that recordings are permanently deleted after 24 hours, but transcripts may be retained for up to eight weeks for security, quality control, or complaint handling purposes. Processing is done by partners such as Tavus, Google Gemini, and Deepgram, with some of the infrastructure located in the US.
Xicoia states that conversations and recordings are not used to train models. However, the policy describes processing by several providers, including video, transcription, storage, and language modeling services. For the user, this means the data journey is longer than Talking Tilly.
The company also states that some calls may be reviewed by automated systems or authorized personnel for security purposes. If a conversation is flagged, the recording may not be sent to the user, while the transcript remains available for review within the prescribed time limits.
See also: Smart glasses in France's sights for secret video recordings
What Talking Tilly users need to know
Xicoia invokes a legitimate interest for age verification and mood analysis, while for call recording it invokes the performance of the contract. The policy gives the right to object to processing and request deletion, but the practical consequence is clear: anyone who does not accept the camera, microphone and analysis cannot use the service.
Talking Tilly has announced that it will be permanently shut down on September 27, 2026, at 11:59 PM Pacific Time. Until then, users should treat each call as a real processing of personal data, not just a conversation with a digital character. The SecNews technical team recommends avoiding sharing sensitive information and checking the policy before each new use.
See also: Microsoft: AI privacy rules for students in schools
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
