Persona (Age Verification Service)

[rejectconvenience]

I was going to wait to make a video about this, but after reading this privacy policy, I thought I should share this for maximum visibility. It takes a long time to make videos. Let me introduce you to a little company called Persona. This company offers age verification services. Here's what I learned about them this morning.

The following are companies that use Persona to use their verification systems:

OpenAI, Coursera, Square, Twilio, Lime, Reddit, Roblox, VRChat, LinkedIn, Helium, Dakota, 6lock, Heritage Bank NA, Citizen Health, K Health, Zumper, WeTravel, Neighbor, Discogs, BitGo, Coffee Meets Bagel, Zro Bank, Branch, Newton, Remote, AngelList, Preply, Umbrella, Sonder, Rently, MyRent. Empower, UrbanSitter, Outdoorsy, Brex.

They do not have any clarity as to how long they retain your personal information. Oh, the personal information they collect includes the following:

Most importantly, scans of your face. They retain this data on their servers, it's not stored locally. They also collect your name, username, email address, postal address, phone number, age, gender, marital status, financial transactions, credit card numbers, financial account details, photos, documents, emails sent to their service, IP address, device type, OS, browser, other software, geolocation data, usage data, including what pages you view, how long you spend on a page, your actions on those pages, recordings or transcripts of audio or video communications you have with them, inferred data, including your city, preferences and other characteristics. They also collect information from data brokers, third party partners, including social networks, partners of the company, service providers and public information.

Now, let's say that Persona has a data breach. Well, it turns out that you can't sue them at all. You can't be a part of a class action lawsuit or anything. That's because they put a "Class Action Waiver" in this policy. So if you data gets stolen BEYOND what the company already does, you can't take action against them.

Oh yeah, that's right, did I fail to mention that they also share and sell all this user data? This company is just straight up awful.

I greatly encourage you to seek alternatives to the companies listed above. In cases where you can't, just try to mitigate risks by using randomized email aliases, randomized passwords, clearing cookies regularly, uninstalling apps on your phone, deleting accounts you don't need or want anymore, etc. Please try to avoid compliance with this kind of company.

Sources:
https://withpersona.com/customers
https://withpersona.com/legal/privacy-policy
https://ask.vrchat.com/t/age-verification-faq/28458
https://support.reddithelp.com/hc/en-us ... for-my-age

[December_W_Wolf]

This is pretty scary to think about; if I'm ever forced to use that company for a service, regardless of whether I'm already using it or not, I'll definitely ditch it (although to be honest I'm not exactly very comfortable about giving some random company a scan of my passport anyway).

I will quickly mention that I'm quite sure Roblox hasn't always used Persona for their age verification, I remember back when they first implemented the feature to allow VC access they used a company called Veratad (I only know this because I did decide to verify my age with a government-issued ID, which I would not do nowadays but unfortunately the damage has been done). I've looked a little into their privacy policy which I've linked, and while I am by no means well-versed in TOS-ese, it seems they follow a similar ethos based on the fact that some of their wording of how they deal with biometric data is very similar, if not a nigh-perfect match, so do be wary of them as well.

I think I have a long and winding sentence problem lol

[CitricScion]

Here is some ancient internet advice: don't give your personal information to sketchy websites.

If a service I use asks me for my personal information beyond what is typical, then depending on the service I will simple not do that. If that means I only have access to certain parts of the site, or no access at all, so be it. I will not give my personal information to these websites to invade my privacy further. These websites have no right asking for that information.

That being said, the problem is not with the people who will or won't comply, but with a legal system that is forcing them to make a choice. We need to continue to advocate for proper digital privacy legislation that protects users from having to risk their digital wellbeing.

That fact that this is happening at the same time as the Tea data breach is ironic, but maybe a gift in disguise. It shows exactly the risk that the UK is forcing unto their citizens.