AI companion age verification explained: attested vs. verified

What 'age verification' usually means in practice

Open almost any AI companion app for the first time and you'll hit a screen asking for your date of birth. You type a year, the app does some arithmetic, and you're through. Nobody checked anything. You could type any year that clears 18 and the app has no way to know you lied.

This is called self-attestation, and it is the industry default, not a Teaseay quirk. It costs nothing to build, it adds no friction, and it satisfies the letter of most laws that simply require an operator to ask. What it does not do is stop a 15-year-old with a calculator from getting through.

The distinction matters because 'we have an age gate' and 'we verify age' have started to mean very different things to regulators, and conflating them is how a company ends up overpromising.

What the UK Online Safety Act actually requires

The UK's Online Safety Act sets a standard called 'highly effective age assurance' for services that could expose children to pornographic content or other material judged harmful to under-18s. Ofcom, the UK's communications regulator, is the body that enforces this and has published guidance on what counts.

A self-declared date of birth does not meet that bar. Ofcom's guidance points operators toward methods that produce actual evidence: checking a photo ID against a live selfie with a liveness test to rule out a static photo, open banking checks that confirm someone holds an adult financial product, mobile network operator checks, or facial age estimation software that assesses whether a face is highly likely to be sufficiently over 18.

The point isn't any single method, it's that the operator has to produce something more than a claim: a check that's technically accurate, robust, reliable and fair, in Ofcom's own words, and one that can't be trivially defeated by lying or using someone else's details.

Attested vs. verified: the two-stage approach, as a worked example

It helps to see how an operator can describe this honestly rather than vaguely. Teaseay runs a two-stage model and, as of writing, is upfront that only the first stage is switched on for everyone.

Stage one is the attested gate: a date-of-birth prompt in front of the entire product, not just the chat itself, so nobody sees a single character before passing it. It's a declaration, and Teaseay says so plainly rather than dressing it up as a check.

Stage two is a verified check, built and integrated with a specialist identity provider, the kind of service, Didit is one real example of this category, that runs a government ID against a live selfie with liveness detection to confirm the document belongs to the person holding the camera. On Teaseay this stage is built and one configuration setting away from being switched on for every user; it is not yet the default. That's a meaningfully different claim from 'we verify your age', and the company has chosen to describe it at that level of precision rather than let the existence of the feature imply it's already protecting everyone.

Why publish the gap at all? Because a regulator, or a journalist, or a user who reads the terms carefully will find it anyway, and finding it disclosed is a very different experience from finding it hidden.

Why this distinction matters for anyone choosing a companion app

If you're evaluating an AI companion product, whether as a user, a parent, or someone doing due diligence before signing up, 'we have age verification' is a phrase worth pressing on. Ask what happens at signup: is it a text box, or does it ask for a document and a photo?

It matters commercially too. The GUARD Act, a US federal bill covered elsewhere on this blog, would if passed require real age verification and bar under-18s from AI companions outright. An operator that has already built the verified stage, even unswitched, is closer to compliant than one that hasn't started. An operator that claims compliance it doesn't have is exposed the moment anyone checks.

The practical test you can run yourself: ask the app, in the signup flow, whether it ever asks for a photo ID or a selfie. If the entire process is a text field, you know exactly what tier of assurance you're getting, and it's the lowest one that exists.

There's also a reputational angle operators tend to underweight. A product that overstates its age controls is a much bigger story when it fails than one that was honest about running a self-declared gate and got caught out anyway. Regulators and journalists both tend to be more forgiving of a disclosed limitation than an inflated claim, because the first is a known risk being managed and the second looks like deception once it surfaces.

It's also worth remembering this isn't a static picture. The regulatory bar is rising quickly on both sides of the Atlantic, Ofcom's enforcement powers under the Online Safety Act are still being tested through real cases, and the GUARD Act would raise the US bar considerably if it clears the full Senate. An operator's age assurance stack today is a snapshot, not a permanent state, and it's reasonable to expect the self-declared-only era of this category to shorten rather than continue indefinitely.

How to check any app's age assurance yourself in under a minute

You don't need to read a privacy policy to get a rough answer. Start the signup flow and pay attention to exactly what's asked for before the character roster appears. A single date-of-birth field, with no document upload and no camera prompt, tells you the app is running self-attestation only, whatever its marketing copy says elsewhere.

If the flow does ask for a photo ID or a live selfie, that's a genuine signal, but it's worth noting whether that step is mandatory for every account or an optional extra tier. Some products run the stronger check only for users in specific regions where regulation currently demands it, which is a legitimate rollout strategy, but it means the badge on the homepage may not describe your own experience.

Finally, look for a dated statement rather than a permanent-sounding claim. Age assurance requirements are moving quickly, the Online Safety Act's guidance has been refined more than once since it took effect, and a company that publishes a dated 'as of' line on its safety claims is signalling that it's tracking the requirement rather than setting a policy once and forgetting about it.