Regulatory pressure on AI companion platforms has intensified considerably over the past two years. The Online Safety Act 2023 received Royal Assent in October 2023, and Ofcom began issuing binding guidance throughout 2024 and into 2025, pushing platforms that host user-generated or AI-generated adult content to implement robust age verification systems. For users of AI girlfriend services based in or accessible from the UK, understanding what this means in practice is more useful than reading the legislation in the abstract.

What the Online Safety Act Actually Requires

The Online Safety Act does not single out AI companion apps by name, but it does create a tiered duty of care that applies to any regulated service accessible to UK users. Services categorised under Schedule 1 of the Act as hosting pornographic content face the strictest obligations. Platforms must carry out a Children's Risk Assessment, implement age assurance measures that meet Ofcom's published standards, and be able to demonstrate compliance on request. Ofcom published its final Age Assurance Guidance in 2024, setting out what counts as a sufficiently robust method. Simple self-declaration, where a user ticks a box confirming they are over 18, no longer meets the bar.

What the Online Safety Act Actually Requires
What the Online Safety Act Actually Requires

It is worth noting that the UK's broader AI regulatory picture remains fragmented. The House of Commons Library confirmed as recently as June 2026 that the UK has no single AI-specific statute covering AI as a technology in the way the EU AI Act does. Instead, existing sector regulators apply their existing frameworks to AI deployments. For AI companion platforms, that means the Online Safety Act is currently the most directly relevant piece of legislation, supplemented by the UK GDPR and the Data Protection Act 2018.

How Age Verification Works on Joi AI

Joi AI's age verification process is handled by a third-party provider rather than in-house, which is a meaningful distinction. Users are asked to upload a government-issued document, such as a passport or driving licence, alongside a selfie for facial matching. The verification provider checks document authenticity and confirms the user's age. Critically, the ID document itself is deleted after the check is complete. Only the verification status and confirmed age band are retained, not a copy of the document. This approach aligns with the data minimisation principle under UK GDPR and reduces the risk profile for users who are understandably cautious about sharing identity documents with a new platform.

How Age Verification Works on Joi AI
How Age Verification Works on Joi AI

Re-verification is required every 12 months, or sooner if the platform detects suspicious activity. This periodic requirement reflects Ofcom's expectation that age assurance should not be a one-time gate that can be bypassed after initial entry. For users, it means keeping document details current if they want uninterrupted access. For a deeper look at the mechanics of this process, the Joi AI age verification page covers the steps in detail.

Content Filtering and the Safety Obligations That Follow

Age verification is only part of what the Online Safety Act demands. Platforms also have obligations around the content itself. Joi AI applies a two-stage filtering approach: prompt scanning before generation, using keyword and semantic analysis to catch prohibited requests before the model responds, and post-generation review via automated classifiers. Human moderators handle flagged edge cases, and reported content is reviewed within 24 hours.

Prohibited content categories are explicit: content depicting illegal activities, hate speech, non-consensual themes, and any representation involving minors. These prohibitions map closely onto the categories the Online Safety Act designates as priority illegal content, meaning platforms have no discretion to allow them regardless of user preference. Users can report content using an in-app button, and penalties for violations range from a warning through to permanent account suspension.

The reality is that content filtering at scale is imperfect. The vertical dossier data shows that false positives and false negatives both occur with medium frequency on platforms in this space. An appeal system and human review process exist precisely because automated classifiers make mistakes in both directions. If you encounter an incorrect restriction, the route is to use the appeal mechanism rather than attempt to work around the filter, which would likely trigger a suspension. The Joi AI content filtering page outlines the appeals process.

Data Privacy Under UK GDPR

Separate from the Online Safety Act, UK GDPR governs how Joi AI handles personal data. Chat logs, voice recordings, image prompts, and payment data all fall within the definition of personal data. Chat logs are retained for 90 days after account deletion, after which they are purged. Anonymised analytics are kept indefinitely, which is standard industry practice and permissible under data protection law provided the anonymisation is genuine. Storage uses AES-256 encryption at rest and TLS 1.3 in transit, both of which are current best-practice standards.

UK users have a clear set of rights: access to their data, the right to rectify inaccurate information, and the right to deletion. These rights are exercisable through account settings rather than requiring a formal written request, which lowers the friction considerably. Third-party data sharing requires explicit consent and is limited to aggregated, anonymised data shared with research partners. The Joi AI data privacy page documents the full retention schedule and opt-out options.

Pricing, Tiers, and What Verification Applies To

One question that comes up in practice is whether age verification applies only to paid tiers or to the free tier as well. The Online Safety Act's obligations attach to the platform, not to a pricing tier. If the service is capable of generating adult content, verification is required regardless of whether the user is on the free plan or a premium subscription. Free-tier users face the same document check as VIP subscribers paying $29.99 per month.

During a two-week comparison exercise in February 2024 across three platforms at different price points, the data indicated that free tiers typically capped reply length at around 80 words, while paid tiers frequently exceeded 200 words per response. That finding matters in the regulatory context because it suggests users may upgrade primarily for richer interactions rather than to access adult content specifically, which complicates the simple assumption that paywalling equals age assurance. Evidence suggests that platforms relying on subscription fees as a proxy for age verification would not meet Ofcom's standards, because a payment method does not confirm age reliably enough. Document-based verification remains the expected approach.

What UK Users Should Do Now

The practical steps for existing and prospective users are straightforward. Check that you have completed the document-based age verification process, not just ticked a self-declaration box, since older sign-up flows may not have included the full check. Review your data permissions in account settings, particularly the consent options around data processing for marketing and sharing with research partners. Note when your 12-month re-verification window falls due, as missing it may interrupt access without warning.

If you have questions about whether Joi AI's current setup meets your expectations around safety and legitimacy, the is Joi AI safe and is Joi AI legit pages address both compliance status and user experience in more detail. The regulatory landscape is unlikely to remain static: Ofcom is still finalising secondary guidance on several aspects of the Online Safety Act, and further updates to age assurance requirements are expected before the end of 2026.