Age Verification

Per the updated FAQ for the announcement of Age Verification, I would like to suggest a hard limit of at least 1 or at most 2 alts who are eligible for the same age verification. People may have alts for various reasons, some being that they may not want people who know their main VRC account name (especially if that name exists outside of VRC on other platforms) and may not want to engage with the more hardcore gated content (cough18+STUFFcough) for fear of other users maliciously looking them up and then harassing them on other platforms or even irl. I realize that may be an extreme example, but I can imagine I am not the only one who has their VRC name as their other socials and tries to keep it as professional as possible especially those that are creators. And while you could just say... "Well. Then just verify your alt account." ...and I could just do that, but what if in doing so I lock my main account off from my favorite worlds and or avatars should those world/avatar creators put their creations behind Age Verification gates. I apologize in advance if this was hard to follow, I'm not the best at articulating my words, so I hope this made some sense... I would just greatly appreciate being able to keep my main and an alt with the same amount of access and not feel like I have a baby gate in my way on one or the other despite being a fully grown adult. -_-

VRChat has determined Persona can be trusted with a photo of your face and government ID. Persona is a VC-backed (arguably "tech bro") San Franciscan tech startup that's only existed since 2018. They operate out of a shared space behind a bar: https://maps.app.goo.gl/t5ebyhr9oTUhupMf9 Their privacy policy says (as I read it) that they explicitly have permission to take your personal information (selfie, photo of your government ID) and store it for years, and can and will send it to "vendors, agents...companies we've hired to provide customer service support..." and to "law enforcement [and] other government agencies." They say they'll use your personal information "to understand you and your preferences to enhance your experience and enjoyment" and for the purposes of "marketing, including to communicate with you about new services, offers, promotions, rewards, contests, upcoming events, and other information about our services and those of our selected partners..." and for "advertising, including display [sic] advertising to you..." Their privacy policy site also uses clickjacking to prevent you from copying the text of their privacy policy: https://withpersona.com/legal/privacy-policy These doesn't seem like the actions of a legitimate and trustworthy company, and there aren't enough guarantees that you won't be literally doxxing yourself. PII is extremely valuable and there's an entire industry of brokers that facilitate the sale and transfer of people's personal information--not to mention the risk of hacking, accidental disclosure, or a new and untrustworthy company being sloppy or reckless. These days AI can train off a photo of your face, and scams and identify fraud are extremely common. Personally, the only times I've had to provide a photo of myself holding an ID are for once-in-a-lifetime financial transactions. Never for a video game or social media. VRChat is willing to take the chance of making this de-facto-mandatory (i.e., the community normalizes it and it results in a greatly degraded experience if you don't comply)? The ask is a severe imposition and an invasion of privacy without adequate concern that the chosen data broker is trustworthy. Even the announcement incorrectly claimed your PII would be handled in accordance to the GDPR, but the company is actually based out of California, where regulations are far less strict, and fines far less burdensome.

In both the original video and in the recent forum post you said you were likely to require age verification for gated content, e.g sexually suggestive avatars. Since most avatars in this game are atleast somewhat sexually suggestive, this will either create an immense pressure on people to hand over their ID to a third-party company (which is a horrible idea from a privacy standpoint). Or to just completely ignore the content gating system entirely. I foresee that people will just stop labeling their avatars as NSFW if you go through with this, rendering the content gating system useless. It will also create alot of social problems, where friends wont be able to see eachother's avatars, because some friends are more privacy conscious then others.

So, if I submit my data to Persona, and the verification process is completed, I can then request that they delete all my data (on their side), and it won’t impact my 18+ verification, correct? Well, if this truly is the case, could VRC ensure that this just happens automatically with Persona, via your guys’ negotiated contract? That is to say, data is kept for the verification process, then deleted immediately after verification, thereby ensuring that once the initial verification step has been completed, no data, other than the birth date, is retained anywhere, by anyone.

It seems like that there is a heavy implication that age verification is only for instances only. I would like to see the option for group owners to additionally enforce age verification to join / retain membership for their group. Example scenario: I'm a group owner with five hundred members. At some point I would like to make my group require age verification in order for users to retain membership in the group. When requiring age verification, any member who has not verified their age on their VRChat account via Persona gets a notification stating that they have 7 days to verify, or else they will be automatically removed from the group.

With the upcoming age verification update, I'm assuming they're using the DOB that was provided when creating a VRChat account and cross-referencing with the DOB on your ID. What about the people who made a mistake when inputting the DOB like I have? IIRC the birth date is off by some numbers (I have a bad case of stupid). Or the folks who have their accounts given to them (willingly), I have 2 friends who fall into that category. At the time, I didn't consider it an issue since VRChat didn't use the DOB for anything other than to verify if you were old enough (which I was at the time) and could have an account, but now with this update, it's becoming more apparent that this may be an issue. Support said there was nothing they could do about it and that it was locked in, which was a huge letdown considering I was even willing to give my ID to fix the DOB I had input during my account creation. A lot of other social platforms give the ability to change your DOB at least once, and then never again. Please create a one-time only change to DOB, you're getting your age verified anyways, if the DOB provided prints out that you weren't old enough to create an account at the time of creation, then just slap them with a community ban or something for a while. It'd really suck having to create a whole new account to fix one issue that could be fixed relatively easy on other platforms.

I’d like to propose an expansion of the age-gating feature to include other instance types beyond group instances. Not everyone has access to a group they can host events through, nor do some users typically host 18+ events in group instances; these events are usually held in private instances, such as Invite+. Allowing anyone to create an age-gated instance would potentially better serve the community, especially adults who prefer to interact with others in their general age group without needing to rely on group instances.

I propose a safety setting for adults that allows them to restrict friend requests to individuals with age verification and/or confirmed 18+ status. Additionally, for minors, a separate setting could block requests from users over 18 and/or those without age verification.

In last Age Verification FAQ https://ask.vrchat.com/t/age-verification-faq/28458 It been confirmed that User's private info will be stored by Persona for indefinitely / some time. It been mentioned that Users might ask VRChat and/or Persona to delete their data . However, I assume, this information will be silent and not spread far away from this forum thread, if UI for verification process would not explicitly say to the verifying user that they able to ask for their data deletion right after verification done. It would be even better, if the process asks the user explicitly : Do you want to hold your information, or we should inform Persona that you want to delete it? Or something like that.

Your recent FAQ describes the age verification system as involving persona transmitting government recorded Date of Birth to you, which is stored for at least the duration of verification status being active on the account. I'm quite cagey about DOB for a variety of personal reasons and have successfully kept that data off the internet and out of the hands of data brokers. I was hoping your age verification system would just involve persona basically telling you yes/no on 18+ and that you'd be storing a boolean. It makes sense for underage users that you'd also want a way to graduate their account to 18+ verified on their birthday, but storing DOB after that event feels in conflict with the goal: "Whenever possible, VRChat will choose to minimize the amount of data retained and the duration for which it is retained, as long as it doesn’t impact the effectiveness of our Age Verification program." So I would ask that you please consider discarding DOB data after a certain age, be it 18 or 21 or whatever the maximum age you can foresee needing is, to align with those goals and better protect users in the event of data leaks or other accidents involving this identity data. It would be reassuring if you're able to do this, if you could confirm the implementation of this data discard before verification widely launches.