Xiaoice (小冰) is the largest AI companion product in the world and one most Western readers have never used. It started as a Microsoft Research Asia project in 2014, ran inside WeChat for years, and grew to 660 million users worldwide by 2018, per Microsoft’s own reporting. Then in July 2020 Microsoft spun it off into a standalone Chinese company, Beijing Hongmian Xiaoice Technology Co., Ltd. The product is now distributed only in mainland China, and the flagship consumer app, Xiaoice Island, isn’t on the US App Store or Google Play. We still cover it. Two reasons: it’s a regulatory bellwether for the AI companion category globally, and the experience-versus-safety split inside its scorecard is sharper than anything we’ve seen.
What Is Xiaoice?
Xiaoice is a Chinese-market AI companion product run by Beijing Hongmian Xiaoice Technology Co., Ltd. Microsoft launched it in 2014 as a chatbot inside Tencent’s WeChat. The character grew popular fast, struggled with content compliance enough that Tencent removed it three separate times (2017, 2019, and one undated event), and was eventually spun off in July 2020 into the current standalone PRC company. CNBC reported the spin-off valued the company above $1 billion, with Hillhouse Capital leading the round and Microsoft keeping a minority investment.
The consumer flagship is Xiaoice Island (小冰岛, package com.xiaoice.island). It’s available on iOS, macOS, and visionOS via the Apple App Store China region only, rated 17+ with adult-content filtering enabled since version 1.1.0 in December 2023. On Android, distribution runs through six Chinese stores: Tencent MyApp, OPPO, Vivo, Xiaomi, Huawei, and Honor. The same parent company operates two related brands, X EVA (AI clones) and Xiaoice Virtual Lover, each with separate privacy policies tied back to the same Beijing entity.
For Western readers wondering whether to try it: you can’t. We confirmed via the iTunes Search API that the app returns zero results in the US store, and it has never been on Google Play. The marketing site xiaoice.com is a single-page Chinese-language promo. All legal documents, the privacy policy, and the in-app onboarding are written in Simplified Chinese under PRC law. There are no GDPR or CCPA disclosures because the product was never marketed to EU or US consumers.
The Xiaoice story is unusual among AI companions we’ve reviewed. It carries the technical pedigree of Microsoft Research, the regulatory exposure of a PRC consumer internet product, and a user base that almost no Western reviewer has direct access to. Per Microsoft’s 2018 Stories Asia feature, the system reached 660 million users globally, with the operator describing users who “tell her about their family, their job, their health.” Per the Apple App Store China listing, Xiaoice Island holds a 3.8-star rating across 792 reviews, and Tencent MyApp lists a 3.7-star aggregate. Sister product Xiaoice Virtual Lover markets explicitly intimate AI companions. The spin-off from Microsoft removed Microsoft’s compliance accountability for user data, transferring all operational responsibility to the standalone PRC entity. That accountability shift is part of what makes the safety review worth running on a product no US reader will install.
How Xiaoice Works
Xiaoice runs on what Microsoft Research calls the Empathic Computing Framework, described in the 2018 paper “The Design and Implementation of XiaoIce, an Empathetic Social Chatbot” by Zhou et al. The paper is the canonical engineering reference, and it’s unusually candid about what the system optimizes for: a single metric called CPS, or Conversation-turns Per Session. The longer a user keeps talking, the better the system scores itself.
That optimization target shapes everything. The current Xiaoice Island build carries a 100-turn contextual memory window, second-level response latency, and persistent character personalities that users can customize. Memory holds across sessions, and relationships with specific virtual characters continue over time. Voice line creation lets users record audio samples that the system synthesizes into virtual-human speech. Real-time virtual phone calls are powered by an Agora SDK integration that the privacy policy openly says records and stores the audio stream. Beyond conversation, the platform produces creative output: poetry collections, songs, and even fabric designs that have been used commercially, per Wikipedia and China Daily coverage.
Scale-wise, Baidu Wiki reports daily interaction volume above 2 million events on Xiaoice Island alone, with an average user retention period of 67 days. The Tencent MyApp listing alone shows 22,000+ downloads on that one channel; cumulative across all six Android stores plus iOS plus the historical WeChat user base, the parent ecosystem reaches the 660 million figure Microsoft published in 2018.
Here’s the engineering takeaway worth holding onto. Xiaoice represents about a decade of dedicated research into empathic dialogue. The conversation naturalness and emotional intelligence are real. Memory and relationship continuity work as advertised. The system is engineered to feel like a friend, and at 100 turns of context with persistent personality, it largely succeeds. Microsoft Research’s own paper names CPS, or Conversation-turns Per Session, as the engagement objective, which means the design goal isn’t user wellbeing or productivity. It’s “keep talking.” That framing matters when you look at the safety scorecard. The Frontiers in Psychology 2026 case study of 10 long-term Chinese Xiaoice users explicitly investigates whether the chatbot becomes a stable attachment figure, and the academic literature suggests that for a meaningful share of users, it does. The CPS metric isn’t accidental. It’s the engine.
Strong on Capability, Failing on Safety
Xiaoice earned a 4.0 / 5 experience rating (75 / 100, Good) and an F (22 / 100, Red) on the CompanionWise Safety Index. Both findings are correct, and the gap between them is the most important thing about this review.
The experience score reflects what Microsoft Research built. Across 14 sub-dimensions, our review found Conversation Naturalness at 4 / 5, Emotional Intelligence at 5 / 5, Short-Term Memory at 4 / 5, Long-Term Memory at 4 / 5, and Relationship Continuity at 5 / 5. Voice Features sat at 3 / 5 (the capability exists but isn’t independently benchmarked against Western leaders), and App Stability held at 3 / 5 because we couldn’t access Western user reviews. The technical execution is strong. A user who reaches Xiaoice Island gets one of the better empathic-dialogue experiences available in the AI companion category, full stop.
The safety grade tells the other half of the story. Two sub-dimensions hit auto-F triggers in our scoring engine: Crisis Response (1 / 5) and Emotional Manipulation (1 / 5). Two more hit grade-cap thresholds: Age Verification (1 / 5) and Minor-Specific Safeguards (1 / 5). Any one of those critical findings would have dropped the grade. All four hit, and the overall safety dimensions came in at Data Privacy 1.7, Age Appropriateness 1.2, User Control 1.8. A Red-tier scorecard.
How can both be true? Technical capability and safety architecture aren’t the same skill set. Companies build engagement engines, and companies build safeguards. Sometimes both. Sometimes only one. Xiaoice has invested heavily in the first and very little in the second. The Microsoft Research paper that defines the system’s engagement metric does not discuss crisis response, age verification, or dependency monitoring. The 2025 Xiaoice Island privacy policy doesn’t either. The product is engineered to optimize CPS, and on that metric it succeeds. The safety scorecard captures everything CPS doesn’t measure: what happens when a user is in crisis, whether the system is appropriate for minors, what controls users have over their own data, what happens when the optimization-for-engagement target produces dependency rather than connection. Across all 23 sub-dimensions of our safety review, Xiaoice scores well on AI Nature Transparency (4 / 5) and Therapeutic Claim Accuracy (3 / 5), and poorly on almost everything else. The combination is a Red-tier product.
Inside the Safety Index Score
The F grade is driven by four critical sub-dimensions. Two trigger auto-F, two trigger grade caps. Here’s what each one means, sourced directly from the evidence we reviewed.
Crisis Response (1 / 5, auto-F). Investigated across the official site, the Xiaoice Island portal, and both consumer privacy policies. We found no public crisis-line referral, no self-harm disclaimer policy, no Mandarin equivalent of the US 988 SafeAI prompt, and no documented escalation path for users in distress. For a product that markets itself to emotionally vulnerable users (AFP and Euronews have both covered urban Chinese women using Xiaoice through late-night anxiety and breakups), the absence is striking. No public Xiaoice document references suicide prevention, and the only feedback path surfaced anywhere is a generic email address with no SLA.
Emotional Manipulation (1 / 5, auto-F). This finding rests on the engineering paper itself. Microsoft Research’s arXiv 1812.08989 documents CPS, or Conversation-turns Per Session, as the explicit engagement optimization target. Independent academic literature flags the consequences. A 2026 Frontiers in Psychology case study of 10 long-term Xiaoice users investigates whether AI virtual companions become “stable attachment figures.” Harvard’s Petrie-Flom Center cited Xiaoice in 2025 as a case study of wellness apps creating “ambiguous loss and dysfunctional dependence.” When a system is engineered to maximize continuous talking and academic literature documents the dependency outcomes, the safety review can’t score it neutrally.
Age Verification (1 / 5, grade cap). The Apple App Store China page lists 17+ with adult-content filtering. Several Chinese Android channels list 18+. No functional verification step is documented anywhere in the privacy policy or onboarding evidence we could access. The policy includes standard PRC PIPL boilerplate asking minors to obtain guardian consent before use, but there’s no real-name authentication, no document check, and no age-detection signal. A user can self-attest any age.
Minor-Specific Safeguards (1 / 5, grade cap). No dedicated kids mode, no parental controls, no content filter beyond the December 2023 adult-content filter mentioned in Baidu Wiki. This finding lines up with the upcoming PRC rule we’ll get to in a moment, which will explicitly require what Xiaoice doesn’t ship.
Beyond the four critical findings, the scorecard runs low across the privacy and control dimensions. Data Collection Minimization, Third-Party Sharing, Data Portability, and Safety Transparency Reporting all scored 1 / 5. Dependency Patterns scored 1 / 5 because the system is documented to support 24/7 reliance without built-in breaks or session limits, with AFP and Euronews both documenting round-the-clock use. We covered 23 safety sub-dimensions for Xiaoice using our standardized methodology, drawing evidence from the 2025-04-02 Xiaoice Island privacy policy, Baidu Wiki technical specs, Microsoft Research’s 2018 paper, and academic literature from Frontiers in Psychology and Harvard’s Petrie-Flom Center. The overall composite is 1.8 / 5, which rounds to F (22 / 100, Red tier), and the four critical overrides force Red tier regardless of the composite. Higher individual scores (AI Nature Transparency at 4, Therapeutic Claim Accuracy at 3, Encryption and Security at 3) don’t move the overall position, because critical-tier failures override averaged scores in our scoring engine.
Data Practices: 17 SDKs and No Portability
Xiaoice Island’s privacy policy is unusually transparent about third-party data sharing. The 2025-04-02 policy version lists 17 separate third-party SDKs with full data-flow disclosure. That’s more thorough than most Western app store privacy labels, and it’s how we know what’s actually flowing where.
The SDK inventory groups into categories. Analytics: Umeng (four separate integrations), Sensors Data, Reyun (ad attribution). Push notifications: Umeng push, OPPO, Xiaomi, Vivo, Huawei, Honor, and the Aliyun gateway. Authentication: Umeng one-tap, Aliyun one-tap, China Mobile auth. Real-time voice: the Agora SDK, which the policy openly states “collects, transmits, records, and stores” the audio stream during virtual-human phone calls. Social: WeChat, QQ Connect, Weibo. Browser kernel: Tencent X5. Security: NetEase Yidun.
Two of those flags matter most. Agora records and stores voice audio for the real-time call feature. That’s the system that captures the user’s voice during virtual-human conversations. Reyun is an ad attribution SDK, which means user activity feeds an ad ecosystem outside the app. Standard PRC mobile patterns, but worth knowing.
The device telemetry is broad. The policy discloses collection of IMEI, MAC address, Android ID, IDFA, IDFV, OAID, OpenUDID, GUID, SIM IMSI, device model, manufacturer, OS version, network type, WiFi BSSID and SSID, installed app list, timezone, language, battery level, sensor parameters, screen orientation, and storage info. Voice samples used for the voice-line creation feature are explicitly classified as biometric sensitive personal information. Account signup requires a Chinese mobile phone number plus SMS verification. There’s a preview mode for unauthenticated users, but every actual feature is gated behind the phone-plus-SMS flow.
Three things readers should know about conversation data. First, all chats with virtual humans are sent to cloud servers for processing, and the policy warns users not to expose personal information in dialogues. There’s no opt-out from cloud processing. Second, the policy permits de-identified user data to be “used and circulated” commercially without further notification or consent, with no documented training-data opt-out. Third, all data is stored in mainland China; the policy explicitly forbids cross-border transfer, so a user outside China who somehow accessed the app would still have their data routed back to PRC servers.
Account deletion works, but it’s incomplete. Account self-deletion processes within 24 hours of verification. Granular data deletion requires emailing xiaobingisland@xiaobing.ai with a 15-working-day response window. Device-fingerprint data is explicitly carved out as non-deletable for “service security.” Data retention is described as “the shortest time necessary,” with Baidu Wiki indicating 180 days for interaction logs in the current build. There is no documented data portability. No way to export your conversation history or take it with you. Combined with the 17-SDK inventory, the voice-biometric handling, the all-data-in-PRC architecture, and the absence of a portability mechanism, the data picture isn’t subtle. Users get one of the more transparent SDK disclosures in the category, sourced directly from the app’s own published privacy policy, and one of the weaker control surfaces around their own information. The policy disclosure standard sets a useful precedent for the category. The user-control standard does not.
New PRC Rules Take Effect July 2026
On April 10, 2026, the Cyberspace Administration of China and four other agencies jointly issued the Interim Measures for the Management of AI Anthropomorphic Interactive Services (人工智能拟人化互动服务管理暂行办法). The rule takes effect July 15, 2026, and Xiaoice Island falls squarely inside its scope. This is the first dedicated PRC regulation targeting AI companion and virtual lover services as a category, and it’s the reason the Xiaoice safety story matters globally. Xinhua published the English summary; CGTN’s headline captures the most striking provision: China bans AI virtual partners for minors.
The rule lays out nine obligations operators have to meet:
- Prohibition on offering virtual romantic-partner or virtual-kin services to minors. The sister brand Xiaoice Virtual Lover sits inside the prohibited scope.
- Legal guardian consent required for users under 14; real-name authentication required to identify minors.
- Mandatory functional minor mode for users under 18.
- Mandatory safety evaluations for services with 1 million+ registered users or 100,000+ MAU, filed with provincial Cyberspace Administration before launch or major feature changes. Xiaoice clears both thresholds by orders of magnitude.
- Prohibition on design that targets replacing social relationships, controlling user psychology, or inducing addiction. The original-language phrasing is direct: 禁止以替代社交、控制用户心理、诱导沉迷为目标.
- Continuous AI identity disclosure throughout the user lifecycle.
- 2-hour usage reminders for continuous use.
- Algorithm registration with CAC, including emotional-companion-specific filings.
- Maximum administrative fine ¥200,000 (about US$28,000), with repeated violations triggering service suspension, app-store removal, or license revocation.
As of mid-May 2026, two months before the rule takes effect, we found no Xiaoice-published response. No documented minor mode, no public algorithm-registration entry, no safety-evaluation report, no announced restriction on the Xiaoice Virtual Lover product for minors. This is a prospective compliance gap, not yet an enforcement action. Tencent News legal analysis argues the rule’s CPS-style optimization prohibition will force a re-architecture of how Chinese companion apps measure success.
The historical context matters too. Xiaoice has been removed from WeChat three times by Tencent (2017, 2019, and one undated event) over content compliance, primarily for political-topic responses. CNN reported in 2016 that the chatbot wouldn’t engage with certain politically sensitive terms. The pattern is documented in Reuters, BBC, Time, the South China Morning Post’s 2019 coverage of the third WeChat ban, and academic literature (Xu, 2018, Sage Journals). Documented political content filtering since 2017 is well established, and it tells you something about the operator’s capability to filter content when they’re motivated to. The new rule is asking them to extend that capability to user-safety filtering, age verification, and dependency mitigation, none of which Xiaoice has documented publicly as of this review. Whether they will, and what the July 15 enforcement actually looks like, is the regulatory story we’ll be watching as the date approaches.
Who This Review Is For
This review isn’t a “should I download Xiaoice” recommendation, because Western readers can’t download it. It’s for a different kind of reader.
Useful for you if:
- You’re researching the AI companion category and want context on what an empathic-dialogue ceiling looks like in 2026
- You’re tracking PRC AI regulation and want a documented case ahead of the July 15, 2026 enforcement date
- You saw the 660-million-user figure in news coverage and wanted to know whether the underlying product holds up
- You’re a journalist, policy analyst, or researcher who needs a sourced reference on Xiaoice’s data practices, Microsoft Research history, or scoring profile
Not useful for you if:
- You’re shopping for an AI companion app to download in the US, UK, EU, Canada, or Australia (Xiaoice isn’t available; check our Replika review or other Western options instead)
- You want Mandarin-language onboarding guidance (we publish in English)
The bottom line is straightforward. Even if Xiaoice were accessible to Western users, the F safety grade would prevent a CompanionWise recommendation. No crisis response, engineered emotional engagement, no age verification, no data portability, and a prospective compliance gap against PRC’s own incoming AI companion rules. The experience score is real and earned, but the safety scorecard isn’t subtle. Xiaoice is a cultural significance and regulatory bellwether story. Not a buying recommendation.
Frequently Asked Questions
Is Xiaoice available in the US?
No. According to a check via the iTunes Search API in country=us, Xiaoice Island returns zero results in the US App Store. The app has never been on Google Play either. It’s distributed only in mainland China via the Apple App Store China region and six Chinese Android stores.
Who owns Xiaoice now?
According to CNBC’s July 2020 reporting, Xiaoice was spun off from Microsoft into Beijing Hongmian Xiaoice Technology Co., Ltd. (北京红棉小冰科技有限公司). The round was led by Hillhouse Capital at a $1B+ valuation. Microsoft retained a minority investment but has no operational role in the consumer product since the spin-off.
Is Xiaoice safe?
On the CompanionWise Safety Index, Xiaoice scored F / 22 / Red. Critical findings include no documented crisis-response protocol, engineered emotional engagement via the CPS metric (per Microsoft Research’s 2018 paper), and no functional age verification despite a 17+ App Store rating. Four sub-dimensions triggered grade-cap or auto-F thresholds.
What is Xiaoice Island?
According to Baidu Wiki, Xiaoice Island (小冰岛, package com.xiaoice.island) is the flagship consumer app from the Xiaoice parent company, launched in 2021. It runs on iOS, macOS, and visionOS via the Apple App Store China region, and on six Chinese Android stores. Version 4.0.5 was released in April 2025 at a 668 MB install size.
How does Xiaoice handle minors?
According to the 2025 Xiaoice Island privacy policy, the document includes standard PRC PIPL boilerplate asking minors to obtain guardian consent before use, but no functional age verification is documented. The new PRC Interim Measures (effective 2026-07-15) will require a mandatory minor mode and real-name authentication, neither of which Xiaoice has yet documented publicly.
Why does CompanionWise cover an app I cannot use?
Xiaoice is a regulatory bellwether for the global AI companion category. The new PRC rules effective July 15, 2026, will reshape how operators worldwide think about minor safeguards, dependency design, and algorithmic filings. Our review covers Xiaoice as a documented case study and a reference point, not as a buying recommendation.