AI Companion Transparency Index
Who operates the ten largest AI companion apps, whether a UK user has any route to enforce their data rights against them, and what each one actually costs. Free to reuse with attribution.
Headline findings
14 of 16 apps generate images with no content filter, and13 of those use no age assurance beyond a tick-box. Ofcom has said a standalone chatbot sits outside the Online Safety Act only where it does not connect users, does not search multiple sites, and cannot generate pornography — and that chatbots able to generate pornography already fall within the Act's age-assurance duties. On that test these 14 appear to be in scope. The widely repeated claim that companion apps simply fall outside the rules does not survive the test as Ofcom states it.
This matches independent work. The Ada Lovelace Institute's January 2026 market scan of the UK AI companion sector found that of 17 top UK platforms analysed, 15 had weak or non-existent age verification as of July 2025, including sites hosting explicit content. Our sample is smaller and our method differs; the conclusion is the same.
10 of 16 apps do not publish the identity of the operating company — Candy AI, Soulkyn AI, OurDream AI, Nectar AI, GPTGirlfriend, Kupid AI, EVA AI, FantasyGF, LoveScape, Muah AI. Article 13 of the UK GDPR requires a controller to provide its identity and contact details to the people whose data it collects, so this is a compliance gap rather than a stylistic choice. The practical effect is that a UK user has no named controller to serve an access or erasure request on, and no supervisory authority with clear jurisdiction. We make no claim about why the information is absent.
2 of 16 have a UK-linked operator (SweetDream AI and Joi AI) — the only configuration in this set where the Information Commissioner's Office is unambiguously the supervisory authority.
The data
16 apps · checked 26 October 2026
| # | App | Score | Operating company | Jurisdiction | Age assurance | Privacy |
|---|---|---|---|---|---|---|
| 1 | SweetDream AI | 8.3 | Tetractys Development Ltd · no. 17171203 | England | Self-declared 18+ at sign-up; no documented age-estimation step at last check | 8.5 |
| 2 | Kindroid | 8.2 | Kindroid Inc | United States | Self-declared 18+; app-store age ratings apply | 7.5 |
| 3 | Nomi AI | 8.1 | Nomi AI | United States | Self-declared 18+ | 7.5 |
| 4 | Candy AI | 7.5 | not identified | — | Self-declared 18+ | 6.5 |
| 5 | Replika | 7.5 | Luka, Inc. | United States | Self-declared 18+, tightened after the Italian regulatory action | 8.0 |
| 6 | Joi AI | 7.5 | Novi Ltd | United Kingdom | Age assurance introduced for UK users following regulatory attention — the strongest in this review set | 7.5 |
| 7 | Character.AI | 7.4 | Character Technologies, Inc. | United States | Age signals and under-18 restrictions introduced following legal scrutiny | 7.0 |
| 8 | Soulkyn AI | 7.3 | not identified | — | Self-declared 18+ only | 6.0 |
| 9 | OurDream AI | 7.2 | not identified | — | Self-declared 18+ only | 6.0 |
| 10 | Nectar AI | 7.0 | not identified | — | Self-declared 18+ only | 6.0 |
| 11 | GPTGirlfriend | 6.9 | not identified | — | Self-declared 18+ only | 6.0 |
| 12 | Kupid AI | 6.8 | not identified | — | Self-declared 18+ only | 6.0 |
| 13 | EVA AI | 6.8 | not identified | — | Self-declared 18+ and app-store age rating | 6.5 |
| 14 | FantasyGF | 6.8 | not identified | — | Self-declared 18+ only | 6.0 |
| 15 | LoveScape | 6.6 | not identified | — | Self-declared 18+ only | 5.5 |
| 16 | Muah AI | 5.8 | not identified | — | Self-declared only | 2.5 |
→ scroll the table sideways to see every column
Rubric weights
25% Conversation & memory
20% Privacy & UK jurisdiction
15% Value & price clarity
15% Customisation & depth
15% Voice, image & video
10% Safety & age assurance
What is in the dataset
The CSV and JSON carry more than this page shows: all six sub-scores per app, Companies House numbers and incorporation dates where an operator is named, published pricing tiers, what each policy says about training on user conversations and about deletion, platform availability, and the date each record was last checked.
Method, and its limits
Desk evaluation against the published rubric, using each vendor’s live pricing and policy pages, Companies House and public registry records where an operator is named, Ofcom and ICO publications, and aggregated public user reporting. Figures carry the date they were last checked.
This is not a controlled trial. We did not run identical scripted conversations against every app under laboratory conditions, and we do not believe consumer sites that claim to have done so without publishing logs, dates or a protocol. The operator, pricing and policy fields are verifiable against public sources; the behavioural sub-scores are editorial judgements against published anchors.
Where a fact could not be verified — an operating company, most often — the field is left empty rather than filled with a guess, and the app is marked down accordingly. That absence is itself the most interesting finding in the dataset.
Why the operator field matters
UK GDPR gives you rights of access, erasure and portability over your chat logs. Those rights are identical regardless of which app holds your data. Your ability to enforce them is not.
Against a company registered in England you have a named legal entity, an address on the public register, and the ICO as a supervisory authority with statutory powers. Against an operator you cannot identify, in a jurisdiction you cannot determine, you have an email address and hope.
The stakes are specific. The 2024 breach of Muah AI exposed user email addresses alongside chat prompts — intimate material attached to identifiable people, with no company to hold responsible. That is the scenario the operator column is about.
Use this data
Licence
- LicenceCreative Commons BY 4.0
- You mayRepublish, adapt and build on it, including commercially
- You mustCredit bestaigirlfriend.uk and link to this page
- CostFree. No registration, no API key, no rate limit.
Formats
- CSV/research/transparency-index.csv
- JSON/research/transparency-index.json
- CORSEnabled, so you can fetch it straight into a chart
- Updated26 October 2026 · version 1.0