AI companion apps, the chatbots sold as girlfriends, boyfriends and friends, have had a rough year with regulators. California’s companion chatbot law took effect in January 2026, New York’s a few months earlier, the UK’s Online Safety Act has required strong age checks on adult services since July 2025, and Australia’s rules began to bite in early 2026. In India, the IT Ministry’s draft rules on AI-generated content and the ongoing debate about age-gating social platforms point the same way.
So I wanted to know what a user actually sees when they sign up. In September and October 2026 I went through the terms of service, help pages and age-verification notices of 55 AI companion apps, from household names like Character.AI, Replika and Nomi to small web-only services. The method and every app’s result are in this comparison of age checks across AI companion apps, which I will summarise here.
The checkbox is still the norm
Of the 55 apps, 41 rely on nothing more than a typed date of birth or a tick box. Five don’t describe any check at all. Only nine use something stronger, anywhere in the world:
- Character.AI runs an age-estimation model on every account and sends anyone it can’t confirm as an adult to a selfie or ID check. It closed open-ended chat to under-18s in November 2025.
- Kindroid estimates age from behaviour and asks flagged free accounts, under two per cent of sign-ups by its own count, for a selfie estimate or an ID.
- Janitor AI, SpicyChat, PolyBuzz, CrushOn AI and Swipey AI use third-party verifiers such as k-ID, Yoti or Ondato, or a small card charge.
- AiAllure and Xeve.ai run a selfie or ID check before adult features unlock.
Four apps set their minimum age at 13 or 14 while offering romantic characters. That contradiction between the sign-up screen and the product is the clearest sign of a policy nobody has read lately.
Where you are decides what you’re asked
The more telling finding is that for most of those nine, the stronger check only switches on in certain countries. Janitor AI reads your IP address and verifies users in the UK, Australia and Brazil. SpicyChat’s selfie check covers France, the UK, Italy, Australia and 26 US states that passed their own age laws. PolyBuzz checks UK users and accepts a typed birthday everywhere else. Only Character.AI, Kindroid and AiAllure apply their checks worldwide.
The pattern is simple: companies verify where a regulator can fine them and keep the checkbox everywhere else. Since several decide by IP address, a VPN changes which rules apply.
For Indian users the practical point is blunt. None of the regional rollouts I found covers India. A 15-year-old in Pune sees the same birthday field a British teenager saw in 2024, on apps whose own terms say they’re for adults.
The trade-off nobody has solved
Stronger checks bring their own problems. Selfie-based age estimation misreads adults who look young, and being locked into “view-only mode” has become a common complaint among Character.AI users since its checks tightened. ID uploads leave copies of identity documents with small companies whose privacy policies often don’t say how long anything is kept. Kindroid says it doesn’t retain verification images; most apps don’t say either way.
There’s also a plain incentive problem. Every extra step at sign-up loses users, and these are subscription businesses. That’s why the checkbox stays until a law forces something else.
What comes next
The direction is clear even if the pace isn’t. Each new national rule produces another regional switch-on, and the apps that already have the plumbing can extend it country by country at little cost. The ones still running on a tick box will either build it or start blocking regions, as some adult services already do.
For users, the check you get depends on where you are, not which app you open. For parents, that means the app-store rating and a birthday field are, across most of the world, the only gate there is.
