The age verification FAQ says:
“VRChat requires your birth date to ensure compliance with our Terms of Service”
I understand why this is the case so long as age hasn’t been verified. However, if someone verifies that they’re 18+, why is retaining the date of birth then required?
Surely, if you can produce a hash confirming that the user is 18+, that then confirms they are complying with the ToS, and the actual date of birth is no longer required?
It seems to me that if you’re storing the minimum necessary PII about your users to carry out this function, then it should be possible for anyone who has confirmed they are 18+ to remove their DOB from your system while retaining that verification.
If the age-verified user is under 18 you could store the date that they turn 18, and on that date replace it with a flag that they are now over 18.
A date of birth is much more personally identifying than a yes/no 18+ flag is. I’d be much more inclined to verify my DOB if an additional benefit was that you could then hold one fewer piece of PII about me.