The short answer is on this page already, so here is the detail behind it — because the detail is where almost every other site covering this gets it wrong, usually in the direction of claiming regulation that does not exist yet.
What is actually legal
Using an AI companion app as an adult in the UK is lawful. Operating one is lawful. There is no licence required, no registration scheme, and no statutory prohibition on AI companionship.
What the law does regulate is content and certain service types. Those two things are the whole of it, and they are narrower than the headlines suggest.
The Online Safety Act: what it actually covers
The Online Safety Act 2023 is the UK’s main online regulation, enforced by Ofcom. It applies to three categories of service:
- User-to-user services — where users encounter content generated, uploaded or shared by other users.
- Search services.
- Services that publish pornographic content — covered by Part 5 of the Act, which carries the requirement for highly effective age assurance.
The question that decides whether an AI girlfriend app is regulated is which of those, if any, it falls into. And for a large part of this category the honest answer is: none of them, at least for now.
The test Ofcom actually applies
A standalone AI companion app is not obviously a user-to-user service, because the content you encounter is generated by a model rather than by another user. It is not a search service. So far so good for the operators.
But Ofcom’s position sets three conditions, and a service has to satisfy all of them to sit outside the Act’s core scope. It must not connect users to one another, it must not search multiple websites or databases, and it must not be able to generate pornography. Ofcom has also said that chatbots which can generate pornography already fall within the Act’s age-assurance duties.
The third condition is the one that decides most of this category. An app built around generating explicit images of a companion you designed is not a service that cannot generate pornography.
Of the ten apps we assessed, eight generate images with no content filter. On Ofcom’s own test they appear to be in scope for age assurance, and seven of those eight ask only that you tick a box. The common claim that these apps simply fall outside the rules does not survive contact with the test as Ofcom states it.
We could not retrieve Ofcom’s pages directly — their site blocks automated access — so this is drawn from reporting of Ofcom’s published position rather than quoted from Ofcom. Read Ofcom’s online safety publications before relying on it. This is general information, not legal advice.
Where chatbots are clearly in scope
Two situations are much less ambiguous:
A chatbot embedded in a regulated service. An AI character operating inside a social network is part of a user-to-user service, and Ofcom has treated it as such — its investigation concerning Grok within X is the prominent example.
A service publishing pornographic content. If an app is publishing pornographic material, Part 5 duties and the highly effective age assurance requirement are engaged regardless of whether an AI generated the material.
The one that got investigated
The most concrete UK data point in this category is Joi AI. Ofcom opened an investigation into Novi Ltd, the provider of the service, concerning its compliance with age-check requirements. Reporting indicates the investigation was subsequently closed after the company introduced age assurance for UK users.
We have flagged that closure as reported rather than confirmed, because we could not verify it against Ofcom’s own enforcement record. But the practical outcome is visible: Joi AI now has meaningfully stronger age checks than almost anything else in this category, and it is the only app in our review set we score above 8 on safety and age assurance for that reason.
It is a useful illustration of how this actually works. Regulation in this space has so far moved app by app, through investigation, rather than through a rule that applies across the category.
Content that is criminal regardless
Nothing about the regulatory grey area around companion apps affects the hard criminal lines, and these apply to you as a user, not only to the operator:
- Any sexual content depicting children is illegal. That it was generated by a model is not a defence. The UK has moved to strengthen rather than weaken this position, and the 2024 Muah AI breach — which exposed prompts reportedly including requests for illegal material alongside users’ email addresses — is a reminder that “I only typed it” is not the protection people assume.
- Extreme pornography offences under the Criminal Justice and Immigration Act 2008 do not have an AI exemption.
- Intimate image abuse. Creating sexually explicit deepfakes of a real person without consent has been legislated against, and using an app’s image tools on a photograph of someone you know is squarely the wrong side of that line.
What about your data?
Data protection is a separate regime and it applies to these apps whatever the Online Safety Act does. UK GDPR and the Data Protection Act 2018 give you rights over your personal data — including your chat logs — and the ICO is the supervisory authority.
The practical difficulty is enforcement rather than entitlement. Your rights against a company registered in England are the same on paper as your rights against an anonymous operator of unknown nationality, and completely different in practice. We cover how to actually use them in your data rights under UK GDPR.
What about the review sites?
Worth knowing, since you are presumably reading several: since 6 April 2025 the Digital Markets, Competition and Consumers Act 2024 has made it unlawful to publish reviews or rankings that conceal a commercial relationship. The rules apply to publishers, bloggers and content creators, not only to the companies being reviewed, and the CMA can impose penalties of up to 10% of global turnover.
A UK-facing comparison site in this category with no visible disclosure is not being discreet. It is breaking the law. Ours is here.
Where this is heading
Two things are worth watching if you want to track this properly.
Parliament. If the gap around standalone companion chatbots is going to close, it closes through legislation. Several sites confidently assert a 2027 deadline for mandatory AI chatbot age verification; we could not find that confirmed by Ofcom or by government, and we are not repeating it.
Elsewhere. Australia’s industry codes explicitly name AI companion chatbots and carry age assurance duties, and the EU AI Act’s Article 50 transparency obligations began applying in August 2026. International operators tend to build to the strictest regime they face and ship it everywhere, so UK users often get the benefit of rules written somewhere else.
What this means for you, practically
- Using these apps is legal. You are not doing anything wrong by being here.
- Most of them are not currently obliged to check your age, and most do not. If that matters in your household, choose on that basis — our age verification guide sets out who actually checks.
- Your data rights exist regardless, but they are far easier to enforce against a named UK company. That is why our rubric weights privacy and jurisdiction at 20%.
- The criminal lines around content involving children and real people are absolute, and apply to what you type as well as to what the app returns.