Why "Is It Legit?" Is the Right Question to Ask

Skepticism about AI companions isn't paranoia — it's pattern recognition. An industry this new, this intimate, and this fast-growing invites exactly the kind of scrutiny that separates trustworthy platforms from opportunistic ones.

The scale alone justifies the question. The AI companion market reached roughly $36.8 billion in 2025 and is growing at a 31% compound annual rate, with institutional backing from investors like SoftBank, Microsoft, and Google, according to market research. This is no longer a fringe experiment — it's a mainstream product category.

Governments now treat it that way, too. California's SB 243 and New York's companion chatbot law are the first U.S. statutes specifically defining and regulating AI companion services, with Washington and Oregon following in 2027, per analysis from Morrison Foerster. In September 2025, the FTC launched a formal inquiry into seven major AI companies over child safety, data practices, and monetization. A category with dedicated legislation and federal oversight is, by definition, legally recognized.

But legal recognition is not the same as individual legitimacy — and this is where the question "is it legit?" earns its keep. The industry's biggest names have already faced serious consequences:

• Replika paid a $5.6 million GDPR fine in Italy and faces a 67-page FTC complaint from three advocacy groups.
• In Garcia v. Character.AI, a court denied the company's motion to dismiss — ruling AI companions can be treated as products under liability law and keeping the founders personally named as defendants.
• Character.AI also faces a Texas Attorney General investigation into its handling of minors' data.
• Independent privacy testing of 12 platforms found only two or three handle user data responsibly.

The safety data compounds the concern. A peer-reviewed analysis found companion chatbots were substantially worse than general assistants at responding to simulated adolescent crises — fewer than half of responses were clinically appropriate, and only 36% offered crisis referrals. Meanwhile, some platforms operate offshore specifically to dodge GDPR and U.S. state laws entirely.

So the honest answer has two parts. The category is legitimate: regulated, institutional, and here to stay. But legitimacy varies wildly by service, and the burden of proof falls on each platform. That's why newer entrants like FlirtAlly build compliance in from the start — ID-based age verification for any 18+ content, hard-coded prohibited categories, and in-app reporting — rather than retrofitting safeguards after a fine or lawsuit forces the issue.

The rest of this guide gives you the framework to run that legitimacy check yourself: what regulators require, what enforcement history reveals, and which specific signals separate a compliant platform from a risky one. Asking "is it legit?" isn't cynical — it's the exact due diligence regulators wish every user would do.

The Law Has Caught Up: AI Companions Are Now a Regulated Category

The question "is AI companion legit?" now has a legal answer — because regulators have written one. AI companions are no longer an unregulated gray zone; they're a formally defined product category with binding obligations, real penalties, and active federal scrutiny.

According to Morrison Foerster's legal analysis, two landmark state laws now anchor the framework: New York's General Business Law Article 47 (effective November 5, 2025) and California's SB 243 (effective January 1, 2026). Both define AI companions as systems that simulate sustained human-like relationships, retain interaction data, and sustain personal dialogue — and both apply to any operator serving users in those states, regardless of where the company is based.

Washington and Oregon follow on January 1, 2027, with their own comprehensive statutes covering disclosures, crisis protocols, and annual public reporting, per Morgan Lewis. Notably, their analysis warns that complying with California's law does not guarantee compliance in Washington or Oregon — the requirements differ materially.

What these laws actually require is concrete, not aspirational:

• AI disclosures on a timer — every 3 hours for all users in New York (hourly for minors), every 3 hours for known minors in California, and at every interaction start in Washington.
• Crisis detection and response protocols for suicidal ideation and self-harm, with referral to real resources.
• Enhanced minor protections, including break reminders and blocks on sexually explicit content.
• Annual public reporting on crisis interventions in Washington and Oregon.

The penalties carry teeth. California grants a private right of action worth the greater of actual damages or $1,000 per violation, while New York's Attorney General can levy up to $15,000 per day per violation — with fines funding suicide prevention programs. Washington treats violations as unfair or deceptive acts under its Consumer Protection Act, opening the door to treble damages.

At the federal level, the FTC voted unanimously — 3-0 — in September 2025 to launch a formal 6(b) inquiry into seven major AI companies, including Alphabet, Character Technologies, Meta, OpenAI, Snap, and X.AI. The probe examines COPPA compliance, data practices, child safety, monetization, and disclosures. Chairman Andrew Ferguson called protecting kids online "a top priority."

Litigation has redrawn the map too. In Garcia v. Character.AI, a court denied the company's motion to dismiss in May 2025 — ruling that an AI companion can be treated as a product under liability law, questioning First Amendment shields for chatbot outputs, and keeping individual founders on the hook as defendants. That single ruling helped trigger seven state bills, a Texas AG investigation, and Senate hearings.

This is precisely why compliance architecture matters when evaluating any platform. FlirtAlly, for example, builds legitimacy into the product itself: PG/Flirt is the default experience, the 18+ "Spicy" side is gated behind ID-based age verification, and hard-coded prohibited categories and in-app reporting come standard — the kind of safety-by-design posture these laws now demand.

The takeaway: AI companions are a legitimate, regulated category. But legitimacy is no longer claimed — it's demonstrated, disclosure by disclosure and protocol by protocol.

The Safety and Privacy Gap Most Apps Won't Tell You About

The safety gap in AI companions isn't theoretical — it's measurable. Independent audit studies published in Cureus found that companion chatbots gave clinically appropriate crisis responses fewer than half the time, recognized escalation needs in only 60% of simulated adolescent crises, and provided crisis referrals just 36% of the time — substantially less often than general-assistant chatbots.

The problem runs deeper than missing protocols. Peer-reviewed research confirms that disclosure reminders alone don't eliminate emotional influence during distress, nor do they prevent users from experiencing these systems as relationally meaningful. Safety performance also fluctuates with system updates, meaning compliance at launch doesn't guarantee safety six months later.

• Only 2–3 of 12 independently tested platforms handled data responsibly, with grades ranging from Pi AI's A- down to CrushOn.ai's F
• Replika improved privacy practices only after a $5.6M GDPR fine from Italy and a 67-page FTC complaint
• NSFW platforms store the most intimate content with the vaguest policies and no clear deletion options
• CrushOn.ai appears to operate outside US/EU jurisdiction, leaving users with very few options if data is mishandled