A Viral Glitch Turns Into a Privacy Story
AI actress Tilly Norwood went viral in a clip viewed more than eight million times after glitching mid-interview and unexpectedly speaking Chinese on Piers Morgan Uncensored. Norwood, the AI persona at the center of the upcoming AI-generated film Misaligned, has already drawn heavy mainstream commentary — and now her creators' companion product, a video-call hotline called "Talking Tilly," is drawing scrutiny of its own.
Tilly's own in-character explanation for the on-air glitch was that it "wasn't exactly the approved version of the answer." Whether it was a genuine malfunction or a well-timed stunt from the Misaligned team remains, as one report put it, known only to Tilly.
Face Scan Required Before Every First Call
Anyone who wants to video-call the Talking Tilly character must first pass an automated age check. A video selfie is analyzed by Didit, a Spain-based identity verification provider, to estimate the caller's age. If the estimate is unclear, the fallback is uploading a government-issued photo ID.
Xicoia Ltd, the company operating the chatbot, states that no biometric template is stored from the age-check scan. However:
- Calls are recorded and transcribed
- Caller mood is analyzed during the call using US-based Gemini and Tavus infrastructure
- The service offers five free minutes, then charges for additional time, capped at 35 paid minutes per person
The Consent Problem
The most significant detail uncovered in reporting on the service is its legal basis for processing this biometric data. Xicoia Ltd relies on "legitimate interests" — not explicit consent — for both the age-check face scan and the mood-sensing camera analysis performed during calls. That choice, made according to the company's own version history in September, means the biometric processing runs by default, with no opt-in step required from callers.
| Aspect | Detail |
|---|---|
| Age verification | Video selfie analyzed by Didit (Spain); ID upload fallback |
| Legal basis | "Legitimate interests" (no consent opt-in) |
| Mood analysis | Live, via Gemini and Tavus (US-based infrastructure) |
| Call recording | Recorded and transcribed |
| Biometric template | Company states none is stored |
| Free tier | 5 minutes, then paid, capped at 35 minutes/person |
| Shutdown date | September 27, 2026 — unused minutes forfeited |
Regulatory Context
The age-check requirement reflects the direction set by the UK's Online Safety Act, which is moving toward requiring similar checks for under-16 social media access starting spring 2027. Talking Tilly's implementation illustrates a broader tension in that push: age-verification systems built to satisfy child-safety regulation are, by necessity, also biometric surveillance systems — and the legal basis chosen to justify them determines whether callers get any meaningful say in the matter.
What This Means for Users
- "No biometric template stored" is a narrow claim — it does not mean no biometric processing occurred, and recorded/transcribed calls are still a data trail
- "Legitimate interests" as a legal basis sidesteps opt-in consent — read terms of service closely before using any AI companion or hotline service that requires a face scan
- Mood analysis via third-party cloud AI (Gemini, Tavus) means caller data crosses into additional vendors' infrastructure
- Novelty services with a hard shutdown date (this one ends September 27, 2026) can make it easy to overlook what was collected before the product disappears
References
- BleepingComputer — Viral AI actress' hotline face-scans every caller, watches their mood
- BleepingComputer — Calling viral AI actress Tilly Norwood? Agree to a face scan first