Calling viral AI actress Tilly Norwood? Agree to a face scan first
AI actress Tilly Norwood's service requires face scans for age verification and mood analysis.
The 'Talking Tilly' AI service, featuring viral AI actress Tilly Norwood, mandates a face scan for age verification via a third-party provider. It also analyzes callers' moods during conversations, with both features relying on legitimate interests rather than explicit consent. The service, which records and transcribes calls using Google's Gemini, is set to shut down permanently on September 27.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'Talking Tilly' AI service required users to submit to biometric face scanning for age verification and real-time mood analysis without obtaining explicit consent, instead relying on the weaker 'legitimate interests' legal basis. This is particularly concerning because biometric and emotional data are among the most sensitive categories of personal information, warranting the highest level of protection. The service also recorded and transcribed all calls via Google's Gemini, creating additional data exposure risks through a third-party provider. This case illustrates how AI-driven consumer services can obscure the true scope of data collection behind novel or entertaining interfaces, leaving users unaware of what they are surrendering. When services are shut down without a clear data deletion policy, the residual risk to users' biometric data persists indefinitely.
What helps against this
How we list vendors- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.