Age Verification Feedback

I'd like to suggest letting users verify their age through their existing Discord age verification status, as an alternative to submitting a government ID to a third-party provider I'm not comfortable handing my ID to an outside company for privacy reasons. Discord's recent age verification rollout automatically verified me as an adult without having to provide any personally identifying information I only need age verification to continue accessing rave venues I’ve been attending for years, which I've been increasingly locked out of due to the mass adoption of this system

which is BS, because its my government drivers license. i do not have a physical copy of my license. it is a digital license. which is accepted Australia wide. so how TF am i supposed to age verify. if you don't accept my license?!?!

Use a different method or business to age verify. Persona has had multiple data leaks and lies about how they store and use data. They do not delete it they keep it and sell it. They are a safety risk and a moral failing.

VRChat has determined Persona can be trusted with a photo of your face and government ID. Persona is a VC-backed (arguably "tech bro") San Franciscan tech startup that's only existed since 2018. They operate out of a shared space behind a bar: https://maps.app.goo.gl/t5ebyhr9oTUhupMf9 Their privacy policy says (as I read it) that they explicitly have permission to take your personal information (selfie, photo of your government ID) and store it for years, and can and will send it to "vendors, agents...companies we've hired to provide customer service support..." and to "law enforcement [and] other government agencies." They say they'll use your personal information "to understand you and your preferences to enhance your experience and enjoyment" and for the purposes of "marketing, including to communicate with you about new services, offers, promotions, rewards, contests, upcoming events, and other information about our services and those of our selected partners..." and for "advertising, including display [sic] advertising to you..." Their privacy policy site also uses clickjacking to prevent you from copying the text of their privacy policy: https://withpersona.com/legal/privacy-policy These doesn't seem like the actions of a legitimate and trustworthy company, and there aren't enough guarantees that you won't be literally doxxing yourself. PII is extremely valuable and there's an entire industry of brokers that facilitate the sale and transfer of people's personal information--not to mention the risk of hacking, accidental disclosure, or a new and untrustworthy company being sloppy or reckless. These days AI can train off a photo of your face, and scams and identify fraud are extremely common. Personally, the only times I've had to provide a photo of myself holding an ID are for once-in-a-lifetime financial transactions. Never for a video game or social media. VRChat is willing to take the chance of making this de-facto-mandatory (i.e., the community normalizes it and it results in a greatly degraded experience if you don't comply)? The ask is a severe imposition and an invasion of privacy without adequate concern that the chosen data broker is trustworthy. Even the announcement incorrectly claimed your PII would be handled in accordance to the GDPR, but the company is actually based out of California, where regulations are far less strict, and fines far less burdensome.

The Chief Technical Officer and Co-Founder of Discord, Stanislav Vishnevskiy, posted a blog recently covering Age Verification and their roll-out plans. https://discord.com/blog/getting-global-age-assurance-right-what-we-got-wrong-and-whats-changing On the 15th Paragraph of the blog post, they talk about Persona and mentioned something very critical. Here is the direct quote from the blog: "One of our core goals with age assurance is to give you options. As part of that, we’ve been evaluating multiple vendors to offer a range of verification options people are comfortable with. One of those evaluations was with Persona, a company used by platforms like Roblox and Reddit. In January, we ran a limited test with Persona in the UK only. After completing the test, we decided not to move forward with them, and consistent with our privacy policy, all data was deleted after completing verification. We’ve set a new bar for any partner offering facial age estimation, including that it must be performed entirely on-device, meaning your biometric data never leaves your phone. Persona did not meet that bar." When I verified myself with Persona through VRChat early on since its implementation, I was informed that the biometric data of my face scan was never gonna leave my device. I trusted Persona on that when I used their website. I don't know if they changed since then. But now, after Discord's own CTO and Co-Founder revealed that Persona failed to keep that part of the promise, it's time for VRChat to consider other options. Personally, I think BlueSky has a decent alternative method for users not willing to submit government documents. BlueSky allows users to verify their unique ownership of the account (to prevent or mitigate impersonators) via their own personal Domains and using those Domains as their BlueSky Handle instead. This is because registering a Domain requires using a real identity and be registered in the Domain Registrar in accordance with ICANN. Although domain regulations will very from country to country. These rules are from the US. And maintaining that registration requires annual upkeep. The Domain Registrar can also hide your name and address at your request and so no one but the Registrar knows who you are. Anyone who looks you up will just see the default name and address of the company with whom you registered your Domain with (examples: GoDaddy, Hover, etc.) and your registration ID is redacted. This provides a layer of protection and I never submitted my government ID to them to register. Just your name, address, and credit card information. I think this method might be more suitable for VRChat as it still offloads the cost and procedure of verification to another company while eliminating the need for submitting an ID altogether. The only downside with this is how this will affect ownership of the user's account should they lapse in their annual upkeep of their Domain in the Registrar (or their equivalent in other countries). Thoughts?

Per the updated FAQ for the announcement of Age Verification, I would like to suggest a hard limit of at least 1 or at most 2 alts who are eligible for the same age verification. People may have alts for various reasons, some being that they may not want people who know their main VRC account name (especially if that name exists outside of VRC on other platforms) and may not want to engage with the more hardcore gated content (cough18+STUFFcough) for fear of other users maliciously looking them up and then harassing them on other platforms or even irl. I realize that may be an extreme example, but I can imagine I am not the only one who has their VRC name as their other socials and tries to keep it as professional as possible especially those that are creators. And while you could just say... "Well. Then just verify your alt account." ...and I could just do that, but what if in doing so I lock my main account off from my favorite worlds and or avatars should those world/avatar creators put their creations behind Age Verification gates. I apologize in advance if this was hard to follow, I'm not the best at articulating my words, so I hope this made some sense... I would just greatly appreciate being able to keep my main and an alt with the same amount of access and not feel like I have a baby gate in my way on one or the other despite being a fully grown adult. -_-

https://kotaku.com/discord-palantir-peter-thiel-persona-age-verification-2000668951 Thiel is the majority owner of persona the age verification provider for vrchat and he has been seen in the epstien files. https://en.wikipedia.org/wiki/Peter_Thiel Not only that, he has a notorious history of privacy violations and is currently helping ICE agents with the capturing of families and american citizens. I implore the devs to seek a new verification provider as association with somone like that puts the trust users have in vr chat at risk.

Dear VRChat Team, I am writing to express my strong desire to support and participate in VRChat’s mature, age-gated communities, while urging the team to implement alternative age assurance methods that do not rely on Persona. While I completely understand and support VRChat's need to comply with global regulations and protect the platform, many dedicated users—including myself—have deep-seated privacy concerns regarding Persona. Given their past data handling controversies, public code exposures, and the widespread community pushback that led platforms like Discord to cut ties with them, I am entirely uncomfortable providing them with my government ID or biometric camera data. Many adult players want to verify their age but feel forced to choose between their digital privacy and accessing 18+ spaces. I would love to see VRChat introduce less invasive verification alternatives, such as: Privacy-first vendors: Partnering with alternative, strictly audited age-estimation providers like Yoti that process scans entirely on-device and instantly destroy pixel data. Non-biometric verification: Implementing alternative checks, such as temporary credit card authorizations or mobile carrier verification, which prove adulthood without requiring facial tracking. VRChat has always thrived because of its community's trust. Offering a choice in how we verify our identity would allow privacy-conscious adults to safely enjoy the full VRChat experience without compromising their personal data. Thank you for your time, your hard work on platform safety, and for listening to community feedback. Sincerely, Smarseille

To put this plain and simple to start: The idea of verifying one's age to gain access to more secure and moderated groups and instances sounds like a good idea at first. However, your current method of age verification (Persona, and frankly any 3rd-party ID Verification service) is, and has already proven to be, an incredible risk to everyone's data privacy and cybersecurity. (Now onto the lengthy part) Persona has been recorded gathering more information other than Age such as: name, address, gender, marital status, and similar demographic details, Social Security Numbers, IP address, device type, your device’s operating system, browser, cookie and device identifiers, and other software including type, version, language, settings, and configuration, geolocation data such as city, state, and country, etc. Persona also has ties to the government data analytics company Palantir. Persona has also been caught building profiles on users and sharing said profiles with the US government and government organizations such as ICE, even having a flagging system to flag users that seemed suspicious. It was also discovered that 269 different checks were used for verification, including things like phone carrier queries and death record matching, and with their privacy policy hiding these checks under vague terms like "public government documents". So this all means that even though Persona says that all data is deleted within the first 3 days (or in some cases, up to 3 years), that data has already been passed off to third-party partners and the US government and does not get deleted. To further prove my point, Other age verification services have had multiple mass breaches of personal information, such as pictures of IDs, Biometric Face Scan data, and more. For example: Infutor, which had a massive data breach where 676,798,866 unique American citizens (including deceased persons) had their data exposed, including full names, date of birth, addresses, cities, state, ZIP codes, phone numbers, and social security numbers. IDMerit also had about 1 billion personal records leaked throughout the world. I am completely unwilling to put my personal data and cybersecurity at risk for a little logo that tells others that I'm over 18. But I believe that there are possible, safer alternatives for age verification My first thought for alternatives is, of course, manual age verification checks performed by VRChat's safety team. This is obviously never going to happen because this would take forever, hiring enough staff members to review all of these age verification requests would be too expensive, and this also comes with security risks. So my next Idea is credit card-based age verification. This is, in my opinion, the best of both worlds. The majority of countries across the world require you to be at least 18 years of age to get a credit card, and currently, you need to have an active VRC+ membership to age-verify. There could very well be a system where if the user pays for a VRC+ membership using a credit card, then they become automatically eligible for the age-verified status. This is personally how I would like to verify my age. I don't currently have a credit card, but I am willing to wait until both I have a credit card and until you get a system like this put in place. But until that day comes, I will never age-verify using Persona or any other ID Verification service. I hope you take everything that I have said into serious consideration moving forward.

They scan your ID against 250+ sources, not to mention keeping a record on you for years after you verify, while having your whole ID and SO many data breaches.