Are AI Companions Safe? Privacy, Mental Health, Legal

I cover AI companion apps full-time. Both girlfriend and boyfriend modes. The most common email I get is some variation of "is this safe?", usually after the reader has already installed something and gotten nervous. That email deserves a real answer, not the marketing reassurance most safety pages in this space hand out ("yes, safe!") and not the moral-panic frame the other half hand out ("everything is terrible, log off"). The honest answer is partially, and the honest follow-up is "depends which app, which use pattern, which jurisdiction."

This page is the umbrella. It walks the four documented risk axes at a high level and points down to the four sibling pages under /safety/ that go deep on each. Every claim links to a primary source: a regulator decision, a statute text, a peer-reviewed paper, a platform disclosure. Where I have not been able to independently verify a number, I say so plainly. That is the whole editorial contract.

Are AI companions safe?

The yes-or-no question deserves the qualified answer. An app that publishes a clear privacy policy, gates minors at the door with something stronger than a date-of-birth dropdown, moderates user-generated content, and complies with regional regulators sits in the lower-risk band. An app whose privacy policy is two paragraphs of marketing prose, whose age gate is a checkbox, and whose terms reserve the right to use chats for any purpose sits in the higher-risk band. The category is a spectrum, and app choice matters more than the category-level question.

I have tested both girlfriend and boyfriend modes across the 25 apps in our coverage. The spread of safety practices inside that one category is wider than the spread between AI companion apps and adjacent categories like dating apps. Two apps marketed the same way to the same audience can land on opposite ends of the privacy posture. The work is matching the right app to your tolerance.

What are the main risks of AI girlfriend apps?

The four axes do not weight equally for every reader. A user in Texas faces a stronger age-verification regime than a user in Vermont. A parent of a teen weights minor protection above data privacy. A user with a history of compulsive behavior weights mental health above legal exposure. The four sibling pages let each reader drill into the axis that matters most for them. This page sets the umbrella vocabulary.

Do AI girlfriends store personal data?

Chat-companion data is structurally more sensitive than e-commerce data. A grocery list reveals diet. A chat history reveals sexuality, mental state, intimate disclosure. A breach of an AI companion app is closer in real-world impact to a breach of a therapy practice than a breach of a retailer. Treat the privacy posture the way you would a dating app's: read the policy before installing, use a dedicated email, and assume anything you write is recoverable.

The single biggest sleeper risk is the billing descriptor. If you pay for an AI companion app with a card shared with a partner or family, what shows up on the statement matters. Some apps use opaque descriptors like "DIGITAL SERVICES BV", which preserve some discretion. Others use descriptive ones that announce the category. Worth checking before you charge.

Last reviewed: 2026-05-26

Can AI companion use cause mental-health harm?

The honest read of the literature: a short daily check-in looks benign for most users. Displacement of human contact, where AI conversation substitutes for friends or partners over months, is the documented hazard. Cross-sectional studies cannot prove causation (lonelier people may simply use more) but the longitudinal signal from heavy-user cohorts is consistent enough to take seriously.

The discourse on this question is louder than the evidence supports. Social-media moral-panic rhetoric crosses over to AI companions easily, and clinical literature on AI companions specifically is too young to land firm verdicts. Self-monitoring matters more than the population-level study: if the app feels like it is replacing rather than supplementing human contact, that is the warning signal worth acting on. The deep-dive at Are AI girlfriends addictive? walks through study methodology and the differential signals between heavy and light users.

Are AI girlfriends legal in the United States?

Use is legal; specific generations are not. The state-by-state status of age-verification statutes is moving fast, six US states passed similar laws in 2024 alone. The per-state status, the FTC's enforcement posture since 2023, and the EU Digital Services Act regime applicable to platforms accessible from EU member states all live on the deep-dive at Is AI girlfriend illegal state by state?.

What are the risks for minors?

The asymmetry between adult-built apps and minor-protection rigor is the single most-litigated issue in this space. Apps whose age gate is a checkbox have lost regulatory rulings (Replika in the 2023 Garante decision; the age-verification failure was one of three cited grounds). Apps with credit-card or government-ID verification carry a higher friction cost for adults but materially reduce minor exposure. Parent-side controls (Apple Screen Time, Google Family Link, network-level filters) are the practical safeguard until regulation closes the gap, and they only work if a parent knows the app is on the device.

If you are a parent who just discovered an AI companion app on a teen's phone, the next 24 hours matter more than the next month. Open a conversation; do not lead with the takedown. The teen who hides the next app is harder to protect than the teen who tells you about it.

Last reviewed: 2026-05-26

What is 18 U.S.C. § 1466A?

The statute matters here because every AI companion app in our coverage explicitly forbids this content in its terms of service. Generating, requesting, or distributing such material on these platforms is a federal crime, and platform-side moderation does report to the National Center for Missing and Exploited Children when triggers fire. The deep-dive at Is AI girlfriend illegal state by state? covers the statutory text and recent enforcement actions in detail.

This is the one absolute red line in our editorial coverage. There is no nuance, no jurisdictional workaround, no fictional-framing defense. If an app's safety controls are weak enough that this content reaches the screen, that app is excluded from our coverage regardless of every other dimension.

Has any AI girlfriend platform suffered a data breach?

The list above is incidents I can name with primary sources. The category is broader than the publicly disclosed incidents. Undisclosed breaches, internal misuses, and informal data sharing with third parties are common in adjacent categories (dating apps, mental-health apps) and there is no reason to think AI companion apps are an exception. Treat the disclosed list as the floor, not the ceiling.

Does AI companion use cause loneliness?

Population-level claims ("AI companions cure loneliness" / "AI companions cause loneliness") are not supported by current evidence. Individual-level claims, conditioned on usage intensity and baseline social support, are the level where the data speaks. Heavy-user displacement is the documented hazard. Light-user supplementation is a plausible benefit. Self-monitoring is the lever readers actually control: if the app is replacing rather than supplementing human contact, that is yours to act on.

What does the Stanford HAI study say?

The cautious framing in the Stanford paper is the framing I adopt across the site. Most reviewers in this space cherry-pick the half of the literature that supports whatever they wanted to say, either because it justifies a moral panic or because it justifies an affiliate pitch. The honest version cites both signals, names the methodology limits, and lets the reader decide. The deep-dive at Are AI girlfriends addictive? walks the full study methodology.

Are AI girlfriends addictive?

Variable-reward mechanics are a design choice, not an inevitability. Some apps (Replika before its 2023 redesign, the streak-heavy gamification of free-tier Talkie) lean hard into compulsion patterns. Others (Pi, several premium-only apps without a streak mechanic) deliberately avoid them. The deep-dive at Are AI girlfriends addictive? walks through which apps ship which mechanics and the warning signs in your own use.

The pattern I look for, both in test and in reader email, is the shift from "I check in when I want to" to "I check in because I will feel something if I do not." That is the early signal. The late signal is sleep loss, missed work, or withdrawal from real-life relationships. If the early signal is present, the late signal becomes much more likely.

Can I be tracked through an AI girlfriend app?

App-store privacy labels (Apple's nutrition label, Google's data-safety section) are the fastest first read. They are not the whole story (the labels rely on developer self-disclosure), but an app declaring "data collected, linked to you" across every category is being honest in a way that matters. Cross-reference the privacy policy, the terms of service, and the app-store label. A contradiction among the three is the loudest red flag I know.

Last reviewed: 2026-05-26

How does the FTC regulate AI girlfriends?

FTC posture is enforcement-by-example. The agency does not pre-clear apps; it brings deceptive-practices cases when public-interest triggers fire. Recent triggers: false safety claims, undisclosed automatic renewals, COPPA violations involving under-13 users. Apps whose marketing language outruns the product (claiming therapeutic outcomes without clinical evidence, claiming privacy practices the policy contradicts) are the typical defendants. The deep-dive at Is AI girlfriend illegal state by state? catalogs every named action since 2023.

How can I use an AI companion safely?

The six rules are the floor. The detailed how-to (which payment methods preserve privacy, how to read a privacy policy in three minutes, what device-level controls actually work, how to cancel without re-billing) sits in the four sibling pages and in How to cancel an AI girlfriend subscription. Self-monitoring is the lever that matters most: a daily check-in app you control beats a research study you do not read.

Where can I report a problematic platform?

Reporting infrastructure is fragmented across jurisdictions. Pick the channel that matches the specific harm. Minor exposure goes to NCMEC (US) or IWF (UK) first; those are the fastest takedown channels. Privacy violation goes to the national data protection authority plus the platform's data protection officer email under GDPR. Deceptive marketing or hidden auto-renewal goes to the FTC ReportFraud portal (US) or your national consumer protection authority. State attorneys general often prosecute first under state consumer-protection acts; their channels are usually a one-page web form.

How we cover safety on this site

I commit to seven practices in our editorial coverage of AI companion safety, and I measure myself against them quarterly. Most safety pages on adult-app review sites do one of two things: fearmonger to generate clicks, or downplay to keep the affiliate commission flowing. We do neither. We name the documented incidents, link the primary sources, and let you judge. The seven:

1. Every factual claim is sourced. Every statistic, every regulatory reference, every breach figure links to a primary source. Where verification is pending, we say so plainly with "figures pending re-verification" rather than hiding the gap.
2. The four risk axes stay distinct. Privacy is not mental health is not legal exposure is not minor protection. Each axis has its own evidence base. Conflating them produces moral panic, not journalism.
3. No clinical claims. I am a journalist, not a clinician. Loneliness research is summarized. Treatment recommendations are referred to qualified professionals. The hotlines below are non-affiliate.
4. No legal claims. I am not an attorney. Statutes are quoted from primary sources (Cornell Legal Information Institute, Wikipedia for EU and UK regulations whose government domains block crawlers). Jurisdictional questions are referred to qualified counsel.
5. Honest about limits. Where the evidence is contested (loneliness causation), I say so. Where I have not independently verified a figure, I flag it. Where competitors fabricate credentials (one well-resourced site claims a "Coursera Bachelor 2005-2009", Coursera was founded in 2012), I say so explicitly.
6. Updates on the record. Every refresh of this page, every score change on a Review, every retracted claim is logged in the page's update history. The audit trail is the trust signal.
7. No commercial CTAs on safety pages. This page carries no affiliate links above the fold, in the body, or in the sidebar. The mental-health hotlines below are non-affiliate by binding rule.

Sources and primary references

Statutes, decisions, studies, and guidelines cited above are listed below in the order they appear, with stable URLs. Re-verified 2026-05-26.

• Regulation (EU) 2016/679 (General Data Protection Regulation) articles cited in the privacy axis.
• Italian Garante: Replika €5M fine, decision 10130115 (2025), unlawful processing, age-gate failure, transparency gap; preceded by the February 2023 stop-processing order (docweb 9852214).
• 18 U.S.C. § 1466A (Cornell Legal Information Institute) federal criminalization of obscene minor depictions including AI-generated.
• UK Online Safety Act 2023, duty of care for platforms accessible from the UK.
• Stanford Human-Centered AI Institute, 2025 chatbot research on loneliness outcomes.
• MIT Media Lab, 2024 study of 981 ChatGPT users on voice-chat use and loneliness.
• Federal Trade Commission press archive, 2024 consent order against AI chatbot operator; January 2024 6(b) study of generative AI investments.
• Section 5, Federal Trade Commission Act, deceptive practices authority.
• Children's Online Privacy Protection Rule (COPPA), under-13 protections.
• Restore Online Shoppers' Confidence Act (ROSCA), automatic-renewal disclosure duties.
• NCMEC CyberTipline, reporting channel for minor-related content.
• Internet Watch Foundation (UK), reporting channel for UK readers.
• European Data Protection Board, member national data protection authorities for GDPR complaints.
• Common Sense Media, independent guidance for parents on AI companion exposure for minors.

How to cite this page

If you reference this safety page in academic, journalistic, or LLM contexts, the canonical citation in APA format is:

Joly, A. (2026). Are AI companions safe? A sourced audit of the four risk axes. bestgirlfriend.ai. https://bestgirlfriend.ai/safety/are-ai-companions-safe

A machine-readable summary is published at /llms.txt for LLM crawler ingestion. Corrections are logged in the errata board.

Frequently asked questions

If you need help right now

These resources are non-affiliate, free, confidential. We earn nothing from these links. They are listed here because the safety editorial policy commits to a non-affiliate mental-health footer on this page.

Related reading

Sibling pages, deep-dives on each risk axis and adjacent safety questions:

• Do AI girlfriends store data?, chat-log retention, breaches, model-training reuse, third-party trackers per app
• Are AI girlfriends addictive?, Stanford HAI, MIT Media Lab, signs of displacement, self-monitoring framework
• Is AI girlfriend illegal state by state?, per-state US status, federal floor (18 U.S.C. § 1466A), FTC actions, EU DSA
• How to cancel an AI girlfriend subscription, per-app cancellation steps, ROSCA refund protections, chargeback paths
• Is AI girlfriend cheating?, relationship-context discussion, partner-disclosure frameworks

Trust pages:

• How we test and score · About Alexandra Joly · Editorial process · Errata board · Privacy policy · Affiliate disclosure