Age checks rolled out in two waves. First came pornography sites, then AI chatbots that can produce sexual material or act as companions. Companion apps got caught in both.
Australia first
Online safety codes. Australia's eSafety Commissioner oversees a set of industry codes made under the Online Safety Act, known as the age-restricted material codes. Three took effect on 27 December 2025 and the rest, including those relevant to chatbots, on 9 March 2026. eSafety says the codes require companion chatbots to protect children from sexually explicit content, either by stopping the service from generating it or by using appropriate age assurance, and to offer crisis and mental health information. The codes are enforceable, with civil penalties of up to A$49.5 million. They do not stop adults from reaching legal content. eSafety has also named AI chatbots that can produce sexually explicit material as a 2026 enforcement priority, and in early 2026 it reported that Character.AI had introduced age assurance for Australian users.
Under-16 social media rule. Since 10 December 2025, the Social Media Minimum Age law has required certain social platforms to take reasonable steps to keep under-16s off. That scheme targets social media rather than companion apps, but it is part of the same push and shows how far Australian regulators are prepared to go.
Elsewhere. In the UK, the Online Safety Act meant services allowing pornography needed "highly effective age assurance" by 25 July 2025, and Ofcom has said generative chatbots that can produce porn are covered. In the US, the Supreme Court upheld a Texas age-verification law in June 2025 (Free Speech Coalition v. Paxton), and companion chatbot laws in several states add protections for known minors. See AI companion laws in Australia and beyond for the local picture.
The platforms themselves. Character.AI ended open-ended chat for under-18s in November 2025, relying on behavioural age estimation, third-party checks and ID as a last resort. OpenAI began rolling out age prediction in ChatGPT in early 2026.
Comparing the methods
Ordered roughly from least to most personal data.
| Method | What happens | What you give up |
|---|---|---|
| Declaring your age | You type in a birth date | Nothing checkable, and not enough where the rules bite |
| Behavioural estimation | The app guesses your age from how you use it | Usage data it already holds |
| Face-based estimation | A selfie is scanned for apparent age | A face image, which reputable providers normally delete afterwards |
| Bank, card or phone-provider check | Your bank or telco confirms you're an adult | Only a yes or no from a third party |
| ID document | A photo of a passport or licence, often plus a selfie | The most sensitive data you have |
| Digital ID or age token | A reusable credential saying "over 18" | Just the age claim, at its best |
How to verify without oversharing
- Pick the gentlest option on offer. If the app lists face estimation or a bank check next to ID upload, skip the ID.
- Prefer a named specialist. A dedicated verification company that publishes how long it keeps data beats an app holding your passport photo on its own servers. After the leaks we cover in AI companion data breaches, that gap is real.
- Check the retention wording. "Deleted straight after verification" is the phrase to look for.
- Avoid using the email tied to your real name where you can. Verification proves your age; it shouldn't link your identity to your chats.
What changes day to day
- Expect more prompts, especially when you switch on adult content, and more of them as the codes bed in.
- Features can vary by country. Some apps switch off NSFW content in a market rather than build the checks, and some have blocked Australia outright. See why some countries get blocked or limited.
- Shared devices need care. If kids use the same phone or tablet, an adult account left logged in undoes the whole exercise. Have a look at using an AI companion on a shared device.
Where it's heading
Age assurance is turning into a standard cost of running an adult-leaning service. The argument has shifted from whether to check to how to check without creating new privacy problems, and reusable age tokens, which prove "over 18" without revealing who you are, look like the best answer. Until they're everywhere, the sensible rule is: take the least invasive method offered, and favour apps that hand checks to specialists rather than collecting documents themselves.