Age Verification Arrived on AI Companion Apps: What the UK, Australia and Brazil Rules Actually Require

Age verification stopped being theoretical for AI companion users in 2026. Platforms rolled it out for users in Brazil, Australia and the UK in response to new laws in those markets, and on June 15, 2026 the UK announced that romantic companion chatbots will be required to enforce a minimum age of 18. In the United States, nothing federal is in force and self-declared birth dates remain the norm.

If a platform you have used for a year suddenly asked you for a document this summer, that is why, and it is geographic rather than personal.

What the UK announced

The June 15, 2026 announcement paired two things. A ban on under-16s using high-risk social media platforms, and a requirement that AI chatbots designed to simulate sexual or romantic relationships enforce an 18 minimum. Intimate functionality is to be restricted for under-18s on chatbots more broadly, not only on the ones marketed as romantic.

The government also asked Ofcom to run a rapid study on effective age assurance for verifying whether a user is over 16, reporting by October 2026, to inform the parliamentary debate. That is the tell that the mechanism is not settled. The policy direction is clear. The implementation is not.

Worth knowing why this announcement was necessary at all: standalone companion apps largely sat outside the Online Safety Act, because the Act keys on user-to-user services and a standalone companion involves only you and the bot. A chatbot embedded in a social platform was already in scope. A dedicated companion app was not. Closing that gap has been under consultation separately.

The loophole critics immediately flagged

A rule aimed at chatbots whose primary purpose is romantic or sexual does not obviously cover a general character platform where users build the romantic character themselves.

That is not a hypothetical objection. It is the structural difference between an AI girlfriend app and a character library, and the second category is where a large share of actual romantic roleplay happens. Whether the eventual regulations reach it depends on drafting that has not happened yet.

The second objection is the one that follows every age gate: enforcement pushes activity toward less visible services rather than eliminating it. That pattern is documented well enough in adjacent categories that it is not really in dispute, and it is the main argument researchers have made for focusing on system design rather than access thresholds alone.

What already happened in Brazil and Australia

Ahead of the UK, new laws in Brazil and Australia forced platforms to implement age verification for users in those countries. Janitor AI announced exactly that in June 2026, describing itself as being required to implement verification for users in Brazil, Australia and the UK.

That is the pattern to expect. Platforms do not build verification because they want to. They build it per market when a specific law makes serving that market otherwise untenable, which is why the experience differs so sharply depending on where you connect from.

What verification actually involves

There is no single method, and the differences matter more than the requirement itself.

A self-declared date of birth is the historical default and is what most platforms still use where nothing compels otherwise. Regulators increasingly do not count it as highly effective age assurance, which is the phrase doing the legal work in the UK framework.

A facial age estimate uses a selfie and returns an estimated age band without necessarily retaining an identity document. This is the method most privacy-preserving in principle, and its accuracy near the threshold is exactly what Ofcom was asked to study.

A document scan is the heaviest option and the one users object to most, because it involves handing a government ID to a company whose core product is storing your intimate conversations.

A card check infers adulthood from payment instrument, which is weak as verification and common as a shortcut.

The part worth thinking about before you comply

The privacy calculus changed the moment identity entered the picture, and it is worth being precise about why.

Before verification, a companion platform held conversations attached to an email address. After verification, some platform or its vendor holds a record linking those conversations to a legal identity. The breach history in this category is not encouraging on this point, and we catalogued it in every major AI companion data breach and what the breaches mean for you.

Two practical things reduce exposure. Read whose verification this actually is, since many platforms use a third-party age assurance vendor and that vendor's retention policy governs your document rather than the platform's. And prefer estimate-based methods over document upload where a platform offers a choice, because a face scan that returns a band and discards the image is a materially smaller footprint than an ID sitting in a bucket.

Where this is heading

The UK is not an outlier. Australia moved first on social media, several European countries have said they are working on similar bans, and in the United States the GUARD Act would ban minors from AI companions and mandate verification federally, having cleared Senate Judiciary 22-0 in April 2026. Several US states already regulate companion and therapy chatbots, which we broke down in California's SB 243.

The broader map, including the jurisdictions where these products are already unavailable, is in where AI companions are actually illegal right now, and the question of whether Western bans are plausible is taken apart in could the West ban AI companions.

What this means for you as an adult user

Practically, three things.

Expect friction to arrive per market rather than all at once, and expect it to arrive first on the platforms large enough to be worth regulating.

Expect some smaller operators to geoblock rather than comply, because building age assurance is expensive and the affected market may not justify it. If a platform you use goes dark in your country, that is the most likely reason.

And expect distribution to keep shifting toward the web rather than app stores, since store policies add a second compliance layer on top of the legal one. Most of the platforms we cover, including Candy AI, OurDream and SpicyChat, already run web-first for exactly that reason.

Keep your own copy of anything that matters to you. That advice predates all of this and survives all of it, and the mechanics are in export and import AI characters.