Close Menu
NCIJ Network NCIJ Network
    What's Hot

    Atletico Madrid vs Real Madrid: La Liga – preview, team news, prediction | Football

    September 19, 2026

    Tired of Cluttered Productivity Apps? This One’s Just a Text Document

    September 19, 2026

    ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

    September 19, 2026
    Facebook X (Twitter) Instagram
    Trending
    • Atletico Madrid vs Real Madrid: La Liga – preview, team news, prediction | Football
    • Tired of Cluttered Productivity Apps? This One’s Just a Text Document
    • ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
    • Bastion conditionally OK for US trust bank
    • Canada shuts down corporate watchdog. Critics say its replacement lacks teeth
    • How We Uncovered That Umar Kremlev Bankrolled Donald Trump Jr.’s Wedding — ProPublica
    • Trump admin considers giving Cumberland Island National Seashore land to private owners
    • Perth shark attack: Rare kill order issued as victim identified as Greg O’Neill
    • About
      • Our Team
      • Editorial Policy
      • Editorial Independence
      • International Support
    • Trust & Standards
      • AI Usage Policy
      • Conflict of Interest Policy
      • Corrections Policy
      • Ethics Policy
      • Fact-Checking Policy
      • Source Protection
    • Get Involved
      • Guide for Sources
      • Support Independent Journalism
    • Legal
      • Cookie Policy
      • Privacy Policy
      • Terms of Use
    Facebook X (Twitter) Instagram
    NCIJ Network NCIJ Network
    Saturday, September 19
    • Home
    • World
    • Ai
    • Business
    • Politics
    • Health
    • Crypto
    • Science
    • Technology
    • Cybersecurity
    • Defense & Security
    • Economy
    • Energy
    • Europe
    • More
      • Fact Check
      • Investigations
      • Opinion & Analysis
      • Environment
    NCIJ Network NCIJ Network
    Home»Cybersecurity

    Calling viral AI actress Tilly Norwood? Agree to a face scan first

    NCIJ NETWNCIJ NETWORKBy NCIJ NETWNCIJ NETWORKSeptember 19, 2026 Cybersecurity No Comments5 Mins Read
    Share
    Facebook Twitter LinkedIn Pinterest Email

    Last night, in a clip viewed more than eight million times, AI actress Tilly Norwood glitched mid-interview and unexpectedly began speaking Chinese on the Piers Morgan Uncensored show.

    Norwood has been the subject of much controversy and mainstream commentary for starring in an upcoming AI-generated film, Misaligned.

    Her creators run a “Talking Tilly” service that lets anyone video-call the AI character behind the viral moment, so today I tried it for myself, and read the fine print most callers won’t.

    A face scan before you can say hello

    Before your first call connects, you must pass an automated age check.

    A video selfie is analysed by Didit, a Spain-based identity verification provider, to estimate your age, with a government photo ID upload as the fallback if the estimate is unclear.

    Viral AI actress live video call hotline prompts you for a video selfie
    Viral AI actress live video call hotline prompts you for a video selfie

    (BleepingComputer)

    Xicoia Ltd, the UK company behind Tilly, states the selfie travels from your device directly to Didit, that no faceprint or biometric template is created, and that neither the selfie nor any ID image is kept after the check; the company says it retains an approximate age band and a reference number instead.

    The check cannot be skipped, applies to callers worldwide, and was only added to the service’s terms this month, alongside a workplace-use ban and new automated safety systems.

    The face scan is not the only analysis running.

    During every call, the system watches your camera feed and listens to your tone of voice to infer your emotional state, so the character can, in the company’s words, respond in a way that fits the mood.

    The privacy policy is candid that this “cannot be switched off for an individual call.” If you don’t want it, don’t call.

    Notably, both the age check and the mood-sensing rely on legitimate interests rather than consent as their legal basis, a choice Xicoia’s own version history shows was made in September.

    Calls are recorded, transcribed, and processed live by US providers, with the character’s responses generated by Google’s Gemini model via conversational video platform Tavus.

    The safety systems have teething problems, too.

    An automated classifier screens each call’s transcript for abusive language and withholds your recording if it flags one.

    One of my three calls, a conversation about the weather and news headlines, was withheld for “hateful or abusive language” that never occurred. The policy says a human reviewer can release wrongly flagged recordings, though recordings are permanently deleted after 24 hours either way.

    Free for five minutes, then the meter starts

    The first five minutes are free. After that, callers are prompted to buy time: £0.99 for a one-time five-minute starter, £13 for 15 minutes, £22 for 30, capped at 35 purchased minutes per person.

    Users get free 5 minutes with Tilly before being asked to pay up
    Users get free 5 minutes with Tilly before being asked to pay up

    (BleepingComputer)

    The fine print matters more than usual here, because the whole service is a limited engagement.

    Every minute, free or paid, expires when Talking Tilly shuts down permanently on September 27, and unused minutes are forfeited.

    Transcripts are retained for up to eight weeks and may be reviewed by Xicoia staff and third-party partners, while the character keeps memory of your previous conversations to personalise future ones, deletable on request.

    In line with where the UK is heading

    An 18+ face scan to talk to a chatbot may sound novel, but it is consistent with the UK’s direction of travel.

    Adult sites serving UK visitors have required ID uploads or facial age estimation since July 2025 under the Online Safety Act, and the government’s under-16 social media ban will make similar checks a fact of life for anyone opening a new social media account from spring 2027.

    The UK government’s announcement of that ban specifically flagged AI companion chatbots for 18+ enforcement (even though the service’s safety docs insist “Tilly is not a companion”), which likely explains why a viral AI character picked up a biometric age gate mid-run.

    The side effect being, a compliance decision driven by UK regulation now face-scans callers everywhere, from Manchester to Ohio.

    Accident or marketing?

    Xicoia, founded by Tilly’s creator Eline van der Velden, describes the character as an awareness project intended to show how far AI video has come.

    EXCLUSIVE: AI actress Tilly Norwood glitches and starts speaking CHINESE during her interview with Piers Morgan and real-life actor Tom Conti…

    Watch the full interview at 7pm (BST)

    https://t.co/1nTb79BH8D@piersmorgan | @TillyNorwoodX pic.twitter.com/DDkveWvVzz


    — Piers Morgan Uncensored (@PiersUncensored) September 18, 2026

    On my call, Tilly’s own explanation of the Piers Morgan moment was that it “wasn’t exactly the approved version of the answer.”

    Talking Tilly goes offline for good at 11:59 PM Pacific on September 27, days after the Piers Morgan appearance.

    Whether last night’s slip was truly accidental, as Tilly cheerfully claimed to me today, or a well-timed stunt from the Misaligned crew, is known to Tilly alone.


    article image

    Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

    Save your seat

    actress agree calling face Norwood Scan Tilly viral
    NCIJ NETWNCIJ NETWORK
    • Website

    Keep Reading

    ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

    Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws

    Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

    Tilly Norwood’s press tour is going about as well as you’d expect for an AI

    Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up

    Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

    Add A Comment
    Leave A Reply Cancel Reply

    Editors Picks

    Atletico Madrid vs Real Madrid: La Liga – preview, team news, prediction | Football

    September 19, 2026

    Tired of Cluttered Productivity Apps? This One’s Just a Text Document

    September 19, 2026

    ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

    September 19, 2026

    Bastion conditionally OK for US trust bank

    September 19, 2026
    Latest Posts

    AIPAC Spending Dominates the Michigan Democratic Senate Primary

    August 5, 2026

    Labour members ‘have tougher view on welfare than you might think’, poll suggests | Labour

    August 5, 2026

    Palantir funnels earnings to US to avoid European taxes, report finds – POLITICO

    August 5, 2026

    Subscribe to News

    Get the latest sports news from NewsSite about world, sports and politics.

    NCIJ Network is an independent digital news platform delivering trusted investigative journalism, European and global news, in-depth analysis, and fact-based reporting with accuracy, transparency, and integrity.

    Facebook X (Twitter) Instagram Pinterest YouTube

    Atletico Madrid vs Real Madrid: La Liga – preview, team news, prediction | Football

    September 19, 2026

    Tired of Cluttered Productivity Apps? This One’s Just a Text Document

    September 19, 2026

    ShinyHunters hacks Clop leak site, threatens to extort ransomware gang

    September 19, 2026

    Subscribe to Updates

    Get the latest creative news from FooBar about art, design and business.

    Type above and press Enter to search. Press Esc to cancel.