If there is one compliance issue that unites regulators across the UK, EU, US and Australia, it is minors. Companion chatbots — especially those offering romantic or adult experiences — are squarely in scope.
What "highly effective" means
The UK's Online Safety Act requires services that allow pornographic content to use highly effective age assurance. Self-declaration ("tick to confirm you are 18") does not qualify. Accepted approaches include:
- Facial age estimation — a selfie analysed to estimate age, usually with a buffer.
- Photo ID matching — a document checked against a live selfie.
- Open banking or credit card checks — confirming the user holds an adult financial product.
- Mobile network operator checks — using the age status on a phone contract.
- Digital identity wallets and reusable age tokens.
The conversion problem
Every extra step at sign-up costs users. Operators report that the biggest drop-off comes not from the check itself but from when it is presented. Common patterns include letting users explore a safe, non-explicit experience first and requesting verification only when they try to access adult features or make a purchase — where permitted by the relevant rules.
Build, buy — or outsource
Most operators do not build age assurance themselves. Specialist vendors offer SDKs, and white-label platforms increasingly bundle verification, billing and compliance into a single service so that brand owners never touch the hardest parts of the stack.
Checklist
- Map which jurisdictions your users come from and which rules apply.
- Choose methods regulators have explicitly recognised.
- Re-verify at moments of elevated risk, not just at sign-up.
- Keep auditable records of your approach and its effectiveness.
- Revisit annually — the rules are moving fast.
Not legal advice. Track the latest rules on our regulation tracker.
