[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fs_l7Pr-a6NUNNQNf6l01gUihwQisI4rN8x8Ar8Y4f_g":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":114},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"092a6938-7470-4ec4-9952-1f1ae42b9aed","Calling viral AI actress Tilly Norwood? Agree to a face scan first","calling-viral-ai-actress-tilly-norwood-agree-to-a-face-scan-first-770903","AI actress Tilly Norwood went viral after glitching into Chinese on Piers Morgan Uncensored last night. Her \"Talking Tilly\" video call service face-scans every caller for an 18+ age check, senses callers' moods during calls, and shuts down permanently on September 27. We tried it and read the fine print. [...]","The 'Talking Tilly' AI service, featuring viral AI actress Tilly Norwood, mandates a face scan for age verification via a third-party provider. It also analyzes callers' moods during conversations, with both features relying on legitimate interests rather than explicit consent. The service, which records and transcribes calls using Google's Gemini, is set to shut down permanently on September 27.","AI actress Tilly Norwood's service requires face scans for age verification and mood analysis.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcalling-viral-ai-actress-tilly-norwood-agree-to-a-face-scan-first\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F04\u002F10\u002Fartificial-intelligence-eyes.jpg","2026-09-19T11:38:20+00:00","2026-09-19T12:00:15.33437+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Gemini","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":19},"Piers Morgan Uncensored",{"name":26,"type":22},"Didit",{"name":28,"type":19},"Talking Tilly",{"name":30,"type":22},"Xicoia Ltd","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":31,"icon":33,"name":34,"slug":35},null,"AI Security","ai-security",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[],[21,26,30],{"controls":57,"vendors":113},[58,87],{"slug":59,"name":60,"problem":61,"products":62},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":88,"name":89,"problem":90,"products":91},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":109,"product_name":110,"url":111,"description":112},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":115,"title":116,"body":117,"framework_refs":118,"framework_notes":130},"ai-service-collects-face-scans-and-mood-data-under-legitimate-interests-loophole","AI Service Collects Face Scans and Mood Data Under 'Legitimate Interests' Loophole","The 'Talking Tilly' AI service required users to submit to biometric face scanning for age verification and real-time mood analysis without obtaining explicit consent, instead relying on the weaker 'legitimate interests' legal basis. This is particularly concerning because biometric and emotional data are among the most sensitive categories of personal information, warranting the highest level of protection. The service also recorded and transcribed all calls via Google's Gemini, creating additional data exposure risks through a third-party provider. This case illustrates how AI-driven consumer services can obscure the true scope of data collection behind novel or entertaining interfaces, leaving users unaware of what they are surrendering. When services are shut down without a clear data deletion policy, the residual risk to users' biometric data persists indefinitely.",[119,120,121,122,123,124,125,126,127,128,129],"GDPR Article 6 (Lawful Basis for Processing)","GDPR Article 9 (Special Categories of Personal Data)","GDPR Article 13 (Transparency & Right to Information)","GDPR Article 17 (Right to Erasure)","GDPR Article 35 (Data Protection Impact Assessment)","NIST Privacy Framework PR.DS-1 (Data at Rest)","NIST SP 800-188 (De-Identification of Government Datasets)","CIS Control 3 (Data Protection)","CIS Control 15 (Service Provider Management)","ITIL Service Design – Information Security Management","ISO\u002FIEC 27701 (Privacy Information Management)",{}]