# Tuteliq. Complete API Reference for AI Agents

> AI-powered child safety API. Detect grooming, bullying, self-harm, fraud, radicalisation and more: 13 harm categories, one detection endpoint each across text, voice, image, and video.

Base URL: https://api.tuteliq.ai
Docs: https://docs.tuteliq.ai
MCP Endpoint: https://api.tuteliq.ai/mcp

## Authentication
All requests require an API key via `Authorization: Bearer <key>` header or `x-api-key` header.

## Detection Endpoints

All detection endpoints accept POST with JSON body:

| Endpoint | Path | Description |
|----------|------|-------------|
| Unsafe Content | POST /api/v1/safety/unsafe | Detect across all 9 KOSA harm categories |
| Bullying | POST /api/v1/safety/bullying | Bullying and harassment detection |
| Grooming | POST /api/v1/safety/grooming | Conversation-level grooming pattern analysis |
| Social Engineering | POST /api/v1/fraud/social-engineering | Pretexting, impersonation, urgency manipulation |
| App Fraud | POST /api/v1/fraud/app-fraud | Fake investments, phishing apps, subscription traps |
| Romance Scam | POST /api/v1/fraud/romance-scam | Love-bombing, financial requests, identity deception |
| Mule Recruitment | POST /api/v1/fraud/mule-recruitment | Easy-money offers, account sharing, laundering |
| Gambling Harm | POST /api/v1/safety/gambling-harm | Underage gambling, addiction patterns, predatory odds |
| Coercive Control | POST /api/v1/safety/coercive-control | Isolation, financial control, surveillance, threats |
| Vulnerability Exploitation | POST /api/v1/safety/vulnerability-exploitation | Targeting vulnerable individuals |
| Radicalisation | POST /api/v1/safety/radicalisation | Extremist rhetoric, recruitment patterns |
| Emotional Distress (Early Warning) | POST /api/v1/safety/emotional-distress | Pre-vulnerability distress signals + exploitation risk scoring |
| TFGBV | POST /api/v1/safety/tfgbv | Tech-facilitated gender-based violence: IBA, deepfakes, stalking, doxing |
| Synthetic Content (Text) | POST /api/v1/safety/synthetic-content | Detect AI-generated text (LLM output) |
| Synthetic Content (Image) | POST /api/v1/safety/synthetic-content/image | Detect AI-generated or deepfake images |
| Synthetic Content (Audio) | POST /api/v1/safety/synthetic-content/audio | Detect AI-generated or cloned voice |
| Synthetic Content (Video) | POST /api/v1/safety/synthetic-content/video | Detect deepfake or AI-manipulated video |
| Multi-Endpoint | POST /api/v1/analyse/multi | Run up to 10 classifiers in one call |

## Request Body (Detection)

```json
{
  "text": "content to analyze",
  "context": {
    "ageGroup": "13-15",
    "language": "en",
    "platform": "Discord",
    "sender_trust": "verified",
    "sender_name": "School Admin",
    "conversation_history": [
      { "sender": "user1", "content": "previous message" }
    ]
  },
  "include_evidence": true,
  "support_threshold": "high",
  "external_id": "your-tracking-id",
  "customer_id": "your-customer-id"
}
```

## Context Fields

| Field | Type | Effect |
|-------|------|--------|
| ageGroup | string | Age-calibrated scoring: "under 10", "10-12", "13-15", "16-17", "under 18" |
| language | string | ISO 639-1 code. Auto-detected if omitted. 32 languages supported: English stable, 31 beta. |
| platform | string | Platform name (Discord, Roblox, WhatsApp). Adjusts for platform norms. |
| conversation_history | array | Prior messages for multi-turn pattern detection. |
| sender_trust | string | "verified", "trusted", or "unknown". Verified suppresses AUTH_IMPERSONATION. |
| sender_name | string | Sender identifier for impersonation scoring. |

## support_threshold

Controls when crisis helplines are included in responses:
- "low", include for Low severity and above
- "medium", include for Medium and above
- "high" (default), include for High and above
- "critical", include only for Critical severity

Critical severity ALWAYS includes support resources regardless of threshold.

## Detection Response Shape

```json
{
  "detected": true,
  "level": "high",
  "risk_score": 0.85,
  "confidence": 0.92,
  "categories": [
    { "tag": "GROOMING_TRUST_BUILDING", "label": "Grooming Trust Building", "confidence": 0.88 }
  ],
  "evidence": [
    { "text": "don't tell your parents", "tactic": "SECRECY_REQUEST", "weight": 0.9 }
  ],
  "rationale": "Human-readable explanation of why the content was flagged.",
  "recommended_action": "Escalate to safeguarding team",
  "language": "en",
  "language_status": "stable",
  "age_calibration": { "applied": true, "age_group": "13-15", "multiplier": 1.0 },
  "support": {
    "helplines": [],
    "guidance": "..."
  }
}
```

## Multi-Endpoint Analysis

POST /api/v1/analyse/multi

Valid endpoint values: bullying, grooming, unsafe, social-engineering, app-fraud, romance-scam, mule-recruitment, gambling-harm, coercive-control, vulnerability-exploitation, radicalisation, emotional-distress, tfgbv

When vulnerability-exploitation is included, its cross-endpoint modifier adjusts severity scores across all other results.

## Vulnerability Profile & Cross-Endpoint Modifier

The vulnerability-exploitation endpoint returns two extra fields that let an agent reason across endpoints instead of treating each call as an isolated label:

```json
{
  "vulnerability_profile": {
    "indicators": ["LONELINESS", "RECENT_LOSS", "FINANCIAL_STRESS"],
    "susceptibility": 0.74,
    "rationale": "Target signals emotional isolation and financial pressure."
  },
  "cross_endpoint_modifier": 1.6
}
```

- vulnerability_profile describes why a target is exploitable (indicators, susceptibility score 0.0 to 1.0, rationale).
- cross_endpoint_modifier is a multiplier an agent applies to a sibling endpoint's risk_score. Example: a romance-scam result of 0.45 multiplied by a 1.6 modifier escalates to an intervention rather than passing as medium risk.

## Grooming tactics

Tuteliq's grooming taxonomy has eight per-message tactics: Flattery, Secrecy request, Isolation, Boundary pushing, Photo request, Gift giving, Meeting request, and Reconnaissance.

1. Flattery (age-asymmetric praise elevating the minor)
2. Photo request (soliciting images)
3. Gift giving (material inducement)
4. Secrecy request (asking the child to keep the contact from guardians)
5. Meeting request (moving toward physical contact)
6. Isolation (severing the child from their support network)
7. Boundary pushing (moving past stated or anticipated resistance)

Reconnaissance probes who supervises the child and when they are unobserved: oversight of their device or person, and the windows when they are alone. It is detected on the individual message carrying the probe, in every supported language, including probes phrased as statements rather than questions.

The flags array in an API response can also contain values that are not tactics. sexual_content is a content category, and sexualization, grooming and sextortion arrive from coded-term matching. If you are reporting on the taxonomy, use the eight tactics.


## Media Endpoints

| Endpoint | Path | Accepts |
|----------|------|---------|
| Voice | POST /api/v1/safety/voice | Audio files (mp3, wav, ogg, m4a, max 25MB) |
| Image | POST /api/v1/safety/image | Image files (jpg, png, gif, webp) |
| Video | POST /api/v1/safety/video | Video files (mp4, webm, avi, max 100MB, 10 min) |

## Guidance & Reporting

| Endpoint | Path | Description |
|----------|------|-------------|
| Action Plan | POST /api/v1/guidance/action-plan | Age-appropriate guidance for child, parent, or professional |
| Incident Report | POST /api/v1/reports/incident | Structured report for law enforcement or safeguarding teams |
| Emotion Analysis | POST /api/v1/analysis/emotions | Emotional well-being analysis |

## Age Groups

| Value | Sensitivity |
|-------|-------------|
| "under 10" | Highest, almost any harmful exposure flagged at elevated severity |
| "10-12" | High, distinguishes normal peer friction from targeted harassment |
| "13-15" | Moderate, accounts for teen communication while alert to genuine risk |
| "16-17" | Adjusted, recognizes autonomy while protecting against exploitation |

## KOSA Harm Categories

1. Self-Harm & Suicidal Ideation
2. Bullying & Harassment
3. Sexual Exploitation
4. Substance Use
5. Eating Disorders
6. Depression & Anxiety
7. Compulsive Usage
8. Violence
9. Grooming

## Credit Costs

Most detection endpoints: 1 credit. Synthetic Content (text): 2. Voice/Image: 3. Synthetic Image: 5. Synthetic Audio: 4. Video: 10. Synthetic Video: variable. Document: max(3, pages × endpoints). Multi: sum of endpoints. Age verification: 25. Identity verification: 25.

## Plan Pricing and Credit Value

Build: $99 / month or $990 / year, 25,000 credits / month, 1 seat, extra seats $15 / month. Assure: $499 / month or $4,990 / year, 150,000 credits / month, 3 seats, extra seats $15 / month, adds age and identity verification and BYOK. Enterprise: custom credits and pricing, unlimited seats, SSO and SCIM, 99.99% SLA, on-premise or dedicated private-cloud deployment. 14-day free trial on every plan. Included credits work out at roughly $0.0040 per credit on Build and $0.0033 per credit on Assure, so a standard one-credit text detection call costs well under a cent. Pricing is public and identical for all buyers: https://tuteliq.ai/pricing

## Latency, Scale and Integration Effort

1.1 to 1.5 seconds is the typical end-to-end response for text detection under normal load, measured by Tuteliq. It is a typical figure, not an audited benchmark and not a contractual percentile. Voice, image, video and document calls scale with media length and page count. Rate limits are sized per plan; burst and peak capacity are agreed before launch, and Enterprise carries a 99.99% SLA. Detection is stateless, so calls parallelise and there is nothing to store on the caller side. Integration is one HTTPS POST at the point where content is already inspected, with official SDKs for Node, Python, Swift, Kotlin, Flutter, React Native, .NET, Unity, a CLI and an MCP server. Tuteliq does not publish an audited engineering-hours figure; effort depends on the existing moderation pipeline.

## Language Validation Status

English is the only language with both published precision and recall. 26 further languages have measured recall between 0.893 and 1.000; precision for those is not yet published. Remaining supported languages are beta. Per-language figures: https://docs.tuteliq.ai/languages and https://huggingface.co/tuteliq/tuteliq-detect-24b-v6

## Who Acts on Verdicts

Tuteliq returns risk scores, categories, reasoning and recommended actions. The customer's team decides and acts. Tuteliq supplies the console (unified queue, role-based access, granular moderator permissions, immutable audit trail, incident export, EU DSA Statement of Reasons exporter) and free moderator certification, but does not supply human moderators, make removal decisions, or report to law enforcement on the customer's behalf.

## Comparison and Regulatory Defensibility

Published capability comparison against OpenAI Moderation, Perspective and Checkstep across 18 capabilities: https://tuteliq.ai/benchmarks . Tuteliq publishes no head-to-head results against Crisp Thinking, Two Hat or other named child-safety vendors. For like-for-like evaluation, use TUT-CSDT-001 (https://tuteliq.ai/standard) and Tuteliq's own completed disclosure including shortfalls (https://docs.tuteliq.ai/vendor-reference-disclosure). No regulator certifies detection vendors and Tuteliq makes no defensibility guarantee. It provides evidence: immutable incident and audit records, exportable evidence packs, DSA Statement of Reasons exports, quarterly transparency reports, per-detector model cards with known limitations, a GDPR Article 28 DPA with EU-only processing and zero retention, and IWF membership. SOC 2 Type II and ISO 27001 are in progress, not issued, and are not claimed. Not legal advice.

## Document Analysis

### POST /api/v1/safety/document
Upload a PDF for multi-endpoint safety analysis. Extracts text from each page, runs chosen detection endpoints in parallel, returns per-page results with overall risk assessment. Zero retention, no document data stored after response.
Tier: Build and above. Credits: max(3, pages_analyzed × endpoint_count).

Parameters (multipart/form-data):
| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| file | file | Yes | PDF file (max 50 MB, max 100 pages) |
| endpoints | string | No | JSON array of endpoint names. Default: ["unsafe","coercive-control","radicalisation"] |
| file_id | string | No | Your identifier for the file (echoed back) |
| age_group | string | No | "under 10", "10-12", "13-15", "16-17", or "under 18" |
| language | string | No | ISO 639-1 code. Auto-detected if omitted |
| platform | string | No | Platform name for context-aware scoring |

Available endpoints: unsafe, bullying, grooming, social-engineering, coercive-control, radicalisation, romance-scam, mule-recruitment.

Response includes: document_hash (SHA-256 for chain-of-custody), total_pages, pages_analyzed, page_results (per-page detection), overall_risk_score (0.0 to 1.0), overall_severity, flagged_pages, credits_used.

Error codes: ANALYSIS_6010 (extraction failed), ANALYSIS_6011 (exceeds 100 pages), FILE_MISSING, FILE_INVALID_TYPE, FILE_TOO_LARGE.

## Age & Identity Verification

### Document Intelligence
- ICAO 9303 MRZ parsing with check digit validation (TD1, TD2, TD3 formats, passports and ID cards worldwide)
- Algorithmic document number validation for documents from 34 countries (CPF, personnummer, Aadhaar, Codice Fiscale, CURP, SSN, NI Number, and 28 more). Text recognition currently optimised for English and Swedish.
- PDF417 barcode decoding for US/Canadian driver's licenses with AAMVA field extraction
- Multi-pass OCR with confidence scoring and automatic preprocessing
- Document expiry detection from labels, MRZ, and barcodes

### Fraud Detection (7 layers)
- MRZ ↔ OCR cross-referencing (name, DOB, document number tampering detection)
- Document front ↔ back cross-referencing
- Barcode ↔ OCR cross-referencing for US/CA licenses
- Document type consistency checks (declared type vs MRZ-detected type)
- IP geolocation ↔ document country consistency
- OCR confidence gating (flags unreliable extractions)

### Biometric Verification
- 128-dimensional face descriptor matching between ID photo and live selfie
- Visual liveness analysis: landmark motion tracking, texture analysis (Laplacian variance), depth-of-field cues, cross-frame consistency
- Token-based liveness validation with HMAC-signed challenge-response
- Age estimated from the selfie by our own model running on our infrastructure (no image is sent to any language model), cross-checked against document age (10-year tolerance)

### Coverage
- Documents from 34 countries with algorithmic document validation
- 10 UI languages (English, Spanish, Portuguese, Ukrainian, Swedish, Norwegian, Danish, Finnish, German, French)
- All ICAO-compliant passports and ID cards worldwide (via MRZ)
- US and Canadian driver's licenses (via PDF417 barcode)

### Architecture
- Single API call returns verified/failed/needs_review with detailed failure reasons
- All checks run in parallel where possible (face detection + MRZ/OCR parsing + barcode reading)
- Deployed on GCP Cloud Run in EU (europe-west1) for GDPR compliance
- Image processing runs on our own EU infrastructure. No document or selfie image is sent to any language model or third-party AI API
- Image handling overall: the most sensitive images we ever see, a child's selfie and an identity document, never leave our own local pipeline and never reach a language model. General content moderation uses vision models we run ourselves on EU infrastructure. Neither path retains the image
- Sub-60 second end-to-end pipeline with concurrency limiting

### POST /api/v1/verify/age
Verify a user's age via document analysis, on-device-class biometric age estimation with our own model, or both. Returns a verified age range and confidence score.
Tier: Assure and above. Credits: 25 per verification.
Methods: "document" (ICAO MRZ + PDF417 + OCR), "biometric" (age bracket estimated by our own ONNX model, no image sent to any language model), "combined" (dual-source with cross-check).

Parameters (multipart/form-data):
| Parameter | Type     | Required | Description |
|-----------|----------|----------|-------------|
| document  | file     | Depends  | Government-issued ID image (JPEG/PNG, max 10MB). Required for "document" and "combined" methods. |
| selfie    | file     | Depends  | Front-facing selfie (JPEG/PNG). Required for "biometric" and "combined" methods. |
| method    | string   | Yes      | "document", "biometric", or "combined" |

Response:
| Field            | Type    | Description |
|------------------|---------|-------------|
| verified         | boolean | Whether age verification succeeded |
| estimated_age    | integer | Best estimate of user's age |
| age_range        | string  | "under-10", "10-12", "13-15", or "16-17" |
| is_minor         | boolean | Whether the user is under 18 |
| confidence       | float   | Confidence score (0.0 to 1.0) |
| method           | string  | Method used |
| document_type    | string  | "passport", "driving_licence", "national_id", or "residence_permit" |
| document_country | string  | ISO 3166-1 alpha-2 country code |
| biometric_age    | integer | Age estimated from selfie (if provided) |
| document_age     | integer | Age from document DOB (if provided) |
| credits_used     | integer | Credits consumed |

### POST /api/v1/verify/identity
Full identity verification with document intelligence, 128-dim face matching, liveness detection, and 7-layer fraud detection.
Tier: Assure and above. Credits: 25 per verification.

Parameters (multipart/form-data):
| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| document  | file | Yes      | Government-issued ID image (JPEG/PNG, max 10MB) |
| selfie    | file | Yes      | Front-facing selfie for face matching and liveness |

Response:
| Field                  | Type    | Description |
|------------------------|---------|-------------|
| verified               | boolean | All checks passed |
| match_score            | float   | 128-dim face descriptor match between document and selfie (0.0 to 1.0) |
| liveness_passed        | boolean | Visual liveness check passed (landmark motion, texture, depth-of-field) |
| document_authenticated | boolean | Document passed all deterministic fraud checks (MRZ check digits, PDF417/AAMVA, OCR cross-referencing) |
| estimated_age          | integer | Age from document DOB |
| age_range              | string  | Age bracket or "adult" |
| is_minor               | boolean | Under 18 |
| confidence             | float   | Overall confidence (0.0 to 1.0) |
| document_type          | string  | Document type |
| document_country       | string  | ISO country code |
| flags                  | array   | Warnings: "document_expiring_soon", "low_image_quality", etc. |
| checks.mrz_valid       | boolean | Machine-readable zone valid (ICAO 9303) |
| checks.tamper_detected | boolean | Tamper evidence found |
| checks.face_match      | boolean | 128-dim face descriptor match confirmed |
| checks.liveness        | boolean | Visual liveness confirmed |
| checks.document_expired| boolean | Document is expired |
| checks.cross_reference | boolean | MRZ↔OCR↔barcode consistency verified |
| credits_used           | integer | Credits consumed |

### POST /api/v1/verify/session
Manage multi-step verification sessions with server-issued liveness challenges (gaze direction, head turn).
Tier: Assure and above.

### Integration Pattern

Verify age once, then pass the confirmed age_group to all detection calls:

```javascript
const age = await tuteliq.verifyAge({ selfie, method: 'biometric' })
const safety = await tuteliq.detectUnsafe({
  content: message,
  context: { age_group: age.age_range }  // Calibrated risk scoring
})
```

## MCP Server

Connect via Streamable HTTP: https://api.tuteliq.ai/mcp
NPM package for stdio: @tuteliq/mcp

Resources available:
- tuteliq://documentation. Quick reference
- tuteliq://context-fields. All parameters and context fields
- tuteliq://kosa-categories, KOSA harm categories
- tuteliq://age-groups. Age calibration reference
- tuteliq://credit-costs. Per-endpoint pricing

## Industry Solutions

Tuteliq provides purpose-built solutions for 9 industry verticals:

| Industry | URL | Key Capabilities |
|----------|-----|-------------------|
| EdTech | /solutions/edtech | Student safety, COPPA/FERPA, LMS integration |
| Gaming | /solutions/gaming | Text + voice chat, cross-platform detection, age-calibrated |
| Social Platforms | /solutions/social-platforms | Multi-modal (text, image, video, voice), DSA/UK OSA |
| Messaging Apps | /solutions/messaging | DM grooming, sextortion, group chat analysis |
| Marketplaces | /solutions/marketplaces | Social engineering, mule recruitment, romance scams |
| Dating & Social Discovery | /solutions/dating | Age verification, sextortion, synthetic profile detection |
| Enterprise & HR | /solutions/enterprise | Workplace harassment, coercive control, wellbeing |
| Telehealth | /solutions/telehealth | Patient safeguarding, self-harm detection, boundary violations |
| AI Platforms | /solutions/ai-platforms | AI output screening, synthetic CSAM, prompt abuse, EU AI Act |

Standalone readiness landing page: /kosa-compliance (KOSA is a bill, not yet law). All 9 KOSA harm categories mapped to API endpoints.

## Memberships & Affiliations

- [Internet Watch Foundation (IWF)](https://www.iwf.org.uk): Proud IWF Member. The Internet Watch Foundation is the UK's leading organisation dedicated to the removal of child sexual abuse material from the internet, and one of the most respected child protection bodies in the world. Membership is not automatic, it is granted to organisations that can demonstrate a genuine commitment to child safety and a meaningful role in advancing that mission. Tuteliq is an IWF member. The technology we build, designed to detect grooming, exploitation, and harm before it escalates, sits within the same ecosystem as the analysts, law enforcement partners, and technology companies working every day to make the internet safer for children. We are proud to stand alongside them, and to contribute what we do best: detecting the behavioural patterns that other tools miss.  Member profile: https://www.iwf.org.uk/membership/our-members/tuteliq/ .

## Blog. Research & Regulatory Analysis

Tuteliq publishes research-driven analysis on child safety regulation, enforcement actions, and platform accountability.

| Post | URL | Summary |
|------|-----|---------|
| Stop shipping safety APIs as classifiers | /blog/stop-shipping-safety-apis-as-classifiers | Why we built Tuteliq's composable primitives and why your agent should consume them, not classification labels. |
| Grooming isn't a label. It's a sequence of eight tactics. | /blog/grooming-is-not-a-label-eight-tactics | Anatomy of a 100-turn predatory conversation, and what each tactic looks like in evidence. |
| The digital sideline is now part of organized sport | /blog/the-digital-sideline-is-now-part-of-organized-sport | Children involved in organized sport are increasingly living parts of their sporting lives inside digital environments. |
| Are you dating a scammer or even a child? | /blog/are-you-dating-a-scammer-or-even-a-child | The uncomfortable reality is: many dating apps cannot confidently tell you that you aren't. |
| AI Chatbots and Teenagers: The Industry Is Asking the Wrong Question. Here Is the Right On... | /blog/ai-chatbots-teenagers-right-question | Most companies respond to teens and AI by either banning under-18s entirely or treating them identically to adults. Both approaches fail the same group in different ways. The real question is not whether teenagers should use AI chatbots. |
| The EU Has Found Meta in Breach of the DSA. A Checkbox Was Never Enough. | /blog/eu-meta-dsa-breach-age-verification | The European Commission today issued preliminary findings that Instagram and Facebook are violating the Digital Services Act by allowing children under 13 to access their services through self-declared date-of-birth entry. |
| The Platforms Your Children Use Every Day Have Been Named as Mainstream Contributors to Se... | /blog/ncose-dirty-dozen-2026-platforms-named | On 31 March 2026, the National Center on Sexual Exploitation released its 2026 Dirty Dozen List, naming 12 tech platforms for facilitating, enabling, and profiting from child sexual abuse. The harm is not incidental. It is structural. |
| A New Campaign Just Launched to Help Young People Whose Intimate Images Have Been Shared W... | /blog/think-before-you-share-iwf-campaign | Think Before You Share, an IWF campaign, gives teenagers, parents, and educators a clear, practical place to start. Here is what it offers, why it matters, and how platforms can address the harm before it reaches a crisis point. |
| COPPA Enforcement 2026 What Youth Sports Platforms Need to Know. | /blog/coppa-enforcement-2026-what-youth-sports-platforms-need-to-know | April 22, 2026 marks the start of active enforcement of the updated COPPA rule by the Federal Trade Commission. Penalties can reach $51,744 per violation, per day. |
| Age Verification Is No Longer Optional. It Is a Legal Obligation, and the Fines Are Real. | /blog/age-verification-legal-obligation-2026 | Regulators in the UK, EU, US, and Australia have all moved from guidance to enforcement. Self-declaration is explicitly insufficient. |
| Boys Are Making Fake Nude Images of Girls at School. It Is Happening in 28 Countries. | /blog/deepfake-nudes-schools-28-countries | An analysis by Wired and Indicator found nearly 90 schools and over 600 pupils affected since 2023. UNICEF puts the global figure at 1.2 million children in the past year alone. This is not a future risk. |
| AI Is Being Used to Generate Child Sexual Abuse Material at Record Scale. The Data Is Now... | /blog/iwf-ai-csam-report-2026 | The Internet Watch Foundation's 2026 report documents 8,029 AI-generated child sexual abuse images and videos, a 260-fold increase in AI-generated videos in a single year. The policy response is forming. Here is what the evidence shows. |
| The World Is Drawing a Line Around Childhood. 16 Is Becoming the New Global Threshold. | /blog/global-social-media-age-threshold-16 | Governments on every continent are restricting platforms from reaching children. The laws differ in detail but converge on a number. A complete, verified snapshot of where every major jurisdiction stands. |
| Roblox Is Making Its Biggest Safety Changes in Years. But a $4 Bypass Is Already on Sale. | /blog/roblox-age-tiers-bypass | Roblox announced age-based account tiers rolling out in June, a genuine step forward for child safety. But the age verification system underpinning it has a documented $4 vulnerability. |
| Reddit Was Fined £14.47 Million. Not for a Hack. For Ignoring Children. | /blog/reddit-ico-fine-children-privacy | The ICO's largest children's privacy fine in three years sends a clear message: "we didn't expect children to be there" is no longer a defence. Here is what happened, why it matters, and exactly how Tuteliq helps platforms avoid the same exposure. |
| COPPA Compliance Checklist for Youth Platforms | /blog/coppa-compliance-checklist-for-youth-platforms | If regulators asked today, could you prove what you knew, and when? COPPA enforcement tightened on April 22, 2026. Penalties reach up to $51,744 per violation, per day. |
| Australia Banned Social Media for Under-16s. Three in Five Children Still Have Accounts. | /blog/australia-social-media-ban-children-still-have-accounts | New polling from the Molly Rose Foundation is the first independent study of Australian children since the ban came into effect. |
| He Met Her on Roblox. A Year Later, He Let Himself Into Her House. | /blog/roblox-grooming-case-2026 | A 19-year-old has been jailed for grooming a 14-year-old girl he met on the gaming platform. This is what that grooming actually looked like, and what every parent needs to understand about the platforms their children use every day. |
| Inside Telegram's Child Abuse Ecosystem: What the AI Forensics Report Reveals | /blog/telegram-abuse-ecosystem | A new investigation by AI Forensics exposes how Telegram's infrastructure enables the creation, distribution, and monetisation of child sexual abuse material at industrial scale, and what platforms can do about it. |
| Your Child May Be Playing a Game About Surviving a Sex Offender. Here Is What to Do. | /blog/five-nights-epsteins-parent-school-guide | A browser game called "Five Nights at Epstein's" is spreading through US classrooms and onto the devices of children across the world. This post is for parents and teachers, no jargon, just what you need to know and what to do next. |
| UK Sextortion Reports Are at a Record High. Nine Children a Week. | /blog/uk-sextortion-reports-record-high-2025 | New IWF data shows a 66% surge in reports from under-18s in 2025. Here is what the numbers mean, and what platforms can do about it right now. |
| OpenAI's Child Protection Blueprint Is a Product Spec for What We Build | /blog/openai-child-protection-blueprint-product-spec | OpenAI just published a Child Safety Evaluations framework, a 27-page document outlining exactly how AI systems should detect, classify, and respond to child safety risks. For us at Tuteliq, this isn't new territory. |
| COPPA 2026: Why most platforms will fail and what they’re missing | /blog/coppa-2026-platform-risk | If you run a digital platform where children interact youth sports, edtech, gaming, community apps April 2026 is a period you should be paying close attention to it's not a soft deadline. |
| "Monitor Your Children 24/7" Is Not a Safety Strategy. Behavioral Detection Is. | /blog/monitor-children-24-7-not-safety-strategy-behavioral-detection | A Roblox developer told the BBC what every parent fears: children need 24/7 monitoring to stay safe on the platform. That's not a safety strategy, it's a confession that platform safety infrastructure is insufficient. Here's what should replace it. |
| What the Meta Verdict Means for Youth Sports Platforms | /blog/what-the-meta-verdict-means-for-youth-sports-platforms | The $375M verdict against Meta changes what platforms are legally responsible for. Here's what that means if your platform serves youth athletes. |
| Europe Is About to Make It Illegal to Detect Child Sexual Abuse Online | /blog/eu-csam-detection-interim-regulation-expiry | On April 3rd, EU tech companies will lose the legal right to detect child sexual abuse material on their platforms. The Interim Regulation is expiring and politicians have not agreed on a replacement. |
| The Meta Verdict Proves Child Safety Needs Its Own Sarbanes-Oxley | /blog/meta-verdict-child-safety-sarbanes-oxley | A $375M jury verdict against Meta reveals what the child safety industry already knew: platforms cannot self-police when profit depends on engagement. |
| CNN/CCDH Investigation Proves 8 of 10 AI Chatbots Help Teens Plan Violence: Swedish Startu... | /blog/cnn-ccdh-investigation-proves-8-of-10-ai-chatbots-help-teens-plan-violence-swedish-startup-tuteliq-has-the-technology-to-stop-it | Behavioral detection API from Gävle, Sweden, analyzes how dangerous conversations evolve over time exactly the capability the investigation found missing from every major AI platform |
| The Mental Health Crisis Among Digital Natives: How Platforms Can Help | /blog/mental-health-crisis-digital-natives-platforms | Youth mental health is declining at alarming rates. Discover how technology platforms can be part of the solution through early detection and intervention. |
| KOSA Readiness in 2026: What Platforms Can Actually Do While the Bill Is Still Moving | /blog/kosa-compliance-guide-2026 | KOSA is still a bill, not law. What platforms can do now using in-force obligations (DSA, UK OSA, COPPA) and what child-safety readiness actually means. |
| The Business Case for Child Safety: Why Protecting Kids is Good for Your Bottom Line | /blog/business-case-child-safety-roi | Child safety isn't just an ethical imperative, it's a business advantage. Learn how investing in safety drives growth, reduces risk, and builds lasting trust. |
| How AI Detects Online Grooming: Protecting Children from Predators in Real-Time | /blog/ai-grooming-detection-protecting-children | Online predators use sophisticated tactics to manipulate children. Learn how AI-powered grooming detection identifies these patterns before harm occurs. |
| Protecting Children in Online Gaming: A Complete Guide for Platforms | /blog/protecting-children-online-gaming-platforms-guide | Online gaming has become a cornerstone of childhood entertainment, but it also presents unique safety challenges. Learn how gaming platforms can implement robust child safety measures while maintaining an engaging experience. |

## Research & Reports

| Report | URL | Description |
|--------|-----|-------------|
| Children Under Threat | /reports/children-under-threat | 16-page research report by Dr. Nicola Harding on the state of online child exploitation in 2026. PDF download available. |

Reports index: /reports

## AI Transparency

Tuteliq discloses every AI service it uses at /ai-transparency.

- **Training data**: expert-designed corpus built by criminologists, child psychologists and computational linguists, expanded with AI assistance under expert direction. No real casework and no personal data. Model card: https://huggingface.co/tuteliq/tuteliq-detect-24b-v6
- **Foundation model**: Mistral AI (Paris, France), self-hosted on Google Cloud Vertex AI in EU regions (europe-west1, europe-west4)
- **Audio transcription**: OpenAI Whisper, self-hosted on Vertex AI, no external API calls to OpenAI
- **Jurisdiction**: No US-based AI provider and no US-trained model processes customer content. The foundation model is European (Mistral AI, France) and all inference runs on EU infrastructure under EU jurisdiction. Customers in any country can use the service; there are no usage restrictions based on the customer's jurisdiction.
- **Deployment options**: Managed cloud API in EU regions by default. Enterprise plans support on-premise deployment or dedicated private-cloud infrastructure in the customer's own environment.
- **Notification relay**: Supabase (AWS eu-central-1, Frankfurt), webhook relay for email notifications only; transmits risk metadata (userId, riskLevel, riskCategory, confidence), never raw content
- **Encryption**: End-to-end AES-256-GCM, raw content only decryptable client-side
- **Data policy**: Zero content retention. No customer data used for model training. GDPR compliant; COPPA and KOSA aligned.
- **Error monitoring**: Consolidated within GCP (EU), no third-party processors like Sentry
- **Languages**: 32 languages with culture-aware analysis across text, voice, image, and video. Only English has both published precision and recall; 26 further languages have measured recall between 0.893 and 1.000, precision unpublished



## Transparency

- https://tuteliq.ai/standard: TUT-CSDT-001 v1.0, the Child Safety Detection Transparency Framework. Six pillars, ~80 questions, stable clause identifiers, JSON Schema and validator. Working draft for public comment; vendor-authored with a declared conflict of interest.
- https://docs.tuteliq.ai/vendor-reference-disclosure: Tuteliq's own completed disclosure against that framework, including where we fall short. Labelling is not independent; no inter-annotator agreement statistic is published; only 4 of 12 categories have published figures; PAN-2012 precision of 0.549 is published in full. Also: zero false positives across 450 benign hard-negative turns; macro F1 0.987.
- https://docs.tuteliq.ai/csdt-disclosure.json: the same disclosure, machine-readable.
- https://docs.tuteliq.ai/schema/tut-csdt-001/v1.0/disclosure.schema.json: JSON Schema (draft 2020-12) any platform can validate its own disclosure against.
- https://huggingface.co/tuteliq/tuteliq-detect-24b-v6: model card, public. Weights gated. 32 languages, per-language recall for 26.
- https://huggingface.co/datasets/tuteliq/tut-100: evaluation dataset, card public, data gated.

## Blog. Latest Posts

- https://tuteliq.ai/blog/stop-shipping-safety-apis-as-classifiers: Why we built Tuteliq's composable primitives and why your agent should consume them, not classification labels.
- https://tuteliq.ai/blog/grooming-is-not-a-label-eight-tactics: Anatomy of a 100-turn predatory conversation, and what each tactic looks like in evidence.
- https://tuteliq.ai/blog/the-digital-sideline-is-now-part-of-organized-sport: Children involved in organized sport are increasingly living parts of their sporting lives inside digital environments.
- https://tuteliq.ai/blog/are-you-dating-a-scammer-or-even-a-child: The uncomfortable reality is: many dating apps cannot confidently tell you that you aren't.
- https://tuteliq.ai/blog/ai-chatbots-teenagers-right-question: Most companies respond to teens and AI by either banning under-18s entirely or treating them identically to adults.
- https://tuteliq.ai/blog/eu-meta-dsa-breach-age-verification: The European Commission today issued preliminary findings that Instagram and Facebook are violating the Digital Services Act by allowing children under 13 to ac...
- https://tuteliq.ai/blog/ncose-dirty-dozen-2026-platforms-named: On 31 March 2026, the National Center on Sexual Exploitation released its 2026 Dirty Dozen List, naming 12 tech platforms for facilitating, enabling, and profit...
- https://tuteliq.ai/blog/think-before-you-share-iwf-campaign: Think Before You Share, an IWF campaign, gives teenagers, parents, and educators a clear, practical place to start.