This thread will be used to answer some of the most frequently asked questions about VRChat’s upcoming Age Verification system.
If you don’t know about it, watch this video first:
In addition, please also watch our Age Verification Improvements video below, which details some recent changes.
Improvements Transcript
Hey everyone, it’s Tupper from the VRChat team. Today, I want to talk about some important changes we’re making to our Age Verification system based on your feedback.
We heard you, and we’ve made some significant improvements to address these concerns.
Here’s what’s changing: Instead of keeping your ID information stored with Persona, we’re implementing a new system that lets us process and verify your information securely, and then immediately delete your personal information. Once verification with Persona is complete, we’ll generate what’s called a “hash” – it’s a sort of digital fingerprint of selected information from your ID. We keep this fingerprint, but the actual ID information is immediately deleted from both VRChat and Persona’s systems.
Hashes are used to store all kinds of information. Just like a fingerprint, the hash lets us know that the ID is valid and isn’t being used for fraud. The hash can’t be reversed out into the original information, just like how you can’t know what a person looks like based off their fingerprint alone.
Here, we’re generating a hash using information from your ID, but they are also commonly used for passwords. They’re useful in cases where you need to verify that what you have matches what a person gives you, but you can’t keep the information itself on hand.
What does this mean for you? Simple: your personal information is stored for the absolute minimum time necessary. As soon as we generate that hash, your ID data aside from your birth date is destroyed, while we keep just enough information in that hash to maintain the security and integrity of the verification system.
This change improves our ability to ensure trust and maintain security. It also significantly improves privacy protections by limiting the amount of data stored and the amount of time it is stored to the absolute minimum. Finally, it gives us more flexibility to adjust our policies about alt accounts based on community feedback.
The verification process itself won’t change – you’ll still use Persona to verify your age, and all the features we announced, like age-verified instances and badges will work exactly the same way.
This hashing change will be implemented before the system is made available to testers.
We’re excited about this improvement because it directly addresses the feedback many of you shared about data privacy and storage. As always, we’re committed to making VRChat better, safer, and a place where you can trust more easily, all while respecting your privacy.
If you’re curious, we’ve also addressed a number of frequently asked questions from the community regarding Age Verification, sourced from our forums, social media, and from the comments in our previous video. Take a look at the description for a link.
Thank you for watching, and we’ll see you in VRChat!
If you have questions you’d like to have answered, please post them in this thread, and we’ll periodically update the FAQ with answers to the most-reacted-to questions.
There may be questions we don’t have the answer to yet, so please don’t be discouraged if we fail to address your question!
Please be aware that we will be removing off-topic posts from this thread. Posts to this thread should be questions for us to answer in the FAQ. Please do not attempt to answer questions for us!
Any feedback, requests for changes to the system, or requests for additional features should be made to the feedback boards. We will remove posts and ask that they be posted to the feedback board instead.
You do not need to post here that you have created a Feedback post.
Changelog
- 2024-12-10 Altered header of post to include the new “VRChat Age Verification Improvements” video. Amended several answers in the FAQ to align with the new hashing approach. New FAQ items have been labeled with [NEW], and amended answers have been noted.
- 2024-12-03 3:20PM PT - Added the section “Additions as of December 3, 2024”, adding 27 new FAQs.
- 2024-12-02 8PM PT - Modified language in the answer for “Who holds my data and what do they do with it?” regarding how VRChat uses your birth date.
- 2024-12-02 - Initial post
What is Age Verification?
Age Verification is a system that allows users to go through a process to validate their age. Once a user has validated their age, they can choose to display a badge that shows “Age Verified” or “Verified 18+” (provided they are 18 or older). They can also choose to display no badge at all. The visibility of this badge can be changed at any time.
Group Instance creators can then lock their instances to Verified 18+ users, creating an adult-only space. Your badge’s visibility on your profile does not affect your ability to access these instances.
In a later update, verification will likely also be used alongside our Content Gating system, preventing certain content from being visible to unverified users or users who have verified but are under 18.
What company is VRChat using for Age Verification?
We’re partnering with Persona, an ID verification company. They’re most well-known for working with customers like Roblox, Reddit, Coursera, OpenAI, Instacart, Square, Lime, and more.
Persona has a Privacy FAQ that can be helpful to read and a CCPA amendment that addresses the CCPA’s requirements.
Where is Persona based?
In San Francisco, which, yes, isn’t what we said in the video. We made an error, sorry about that.
What do I need to submit to verify my age?
You’ll need to submit a picture of your ID and a selfie.
Do you have to submit an un-edited ID to Persona?
Yes, you must send your unedited, full ID to Persona. Obfuscating, blocking, blurring, or otherwise removing information from your ID will cause a failure to verify.
In addition, they may require a “liveliness check,” which involves a selfie. This is done to ensure that the person validating is the person who owns the ID and that you’re a real person, not just someone who generated an ID or grabbed one from their parents.
Is Age Verification mandatory?
No, it is not. You may use VRChat without verifying your age.
What are the benefits of Age Verification?
- Access to Age Verified instances
- Access to the Age Verified badges, including the “Verified 18+” badge if you are 18 or older
- Likely in the future: Integration with a Content Gating system
Can I use the same ID to verify multiple accounts?
At this time, no, you cannot verify multiple accounts using the same ID. Once an ID has been used to verify one VRChat account, it cannot be used to verify other accounts (alts).
We believe the benefits of locking IDs to a single account greatly outweigh the costs. To sum them up:
- Increased trustworthiness of Age Verified Accounts
- Greatly reduced potential for fraud and abuse
- Reduced access to Age Verified instances for malicious users
- Increased account value, which dissuades malicious behavior
- Reduced implementation, maintenance, and complexity
We’ve been talking to group leaders and we’re aware of several cases where this restriction will cause problems, particularly using accounts for logging, cameras, etc. We’re working with them to try to solve this issue.
Some data must be stored with Persona while you maintain a Verified Account that lets us know if an ID has already been used.
Is Persona subject to the GDPR?
Yes, it is. Any company or organization that processes data of users within the EU must comply with the GDPR, even if they aren’t based in the EU (GDPR Article 3).
Companies that violate these regulations face fines, and failure to pay those fines means other significant penalties.
Persona is also subject to the CCPA, California’s data privacy law, which is similar to the GDPR and other applicable state privacy laws. Currently, 19 other US states have adopted similar regulations.
We have entered into a DPA (Data Processing Addendum) with Persona, which contractually obligates Persona to comply with the GDPR, CCPA, and all other applicable privacy laws.
What if I don’t live in the EU or California?
Our DPA with Persona requires them to comply with all applicable data protection laws, giving our users the maximum level of regulatory protection applicable.
Even if you don’t live in the EU, California, or other jurisdictions with comprehensive data privacy legislation, your data will benefit from the DPA. Our DPA with Persona obligates them to handle all personal information responsibly, regardless of region.
Additionally, requests such as “the right to be forgotten” will be honored whenever possible, regardless of your location.
How do you ensure that minors cannot bypass Age Verification?
Persona employs checks that effectively prevent misrepresentation during the verification process.
However, no process is foolproof. As such, our Trust and Safety team will analyze reports and follow up when verification is suspected to be falsified.
While the process is not perfect, it is far more effective than any other method.
Can my ID information be removed from VRChat/Persona servers?
Yes! You can contact our Support team or Persona’s team at any time to have your information removed.
If you ask us to remove all of your information from the VRChat servers, this may affect your Verification status or your account may become unusable.
[NEW] The “changes” video mentioned a hash. What is that?
A hash is a fixed-length string of characters that uniquely represents data of any size, created through a mathematical function that transforms the input in a consistent but non-reversible way. Think of it as a digital fingerprint – just as each person has a unique fingerprint, each piece of data produces a unique hash value when processed through the same hashing algorithm.
Hashes are used to store passwords and other secure information in cases where you need to validate that one value matches a provided value, but you don’t want to store the original value itself. When you enter your password on a website, for example, the website does not store your password. Instead, it hashes your input and compares it to the stored hash rather than comparing the actual passwords.
Hashes used for these secure purposes are non-reversible, meaning you cannot “undo” the calculation to get the original string if you have the hash. This is a fundamental property that makes hashes useful for security – they work like a one-way street, allowing you to verify data without exposing the original content.
While attempting to reverse a hash through brute-force methods or lookup tables is mathematically possible, this process is extremely time-consuming and computationally expensive. To protect against such attacks, security best practices include techniques like “salting” and “peppering.” A “salt” is a random value added to the secure data before hashing, ensuring that identical passwords produce different hashes. A “pepper” is a secret value added to all secure data, providing an additional layer of security. These techniques make brute-force attacks and rainbow table attacks practically impossible.
Calculating the hash itself is done carefully, ensuring that sophisticated attacks against the hashing system cannot reveal personal information.
When we receive verification from Persona, they send us some information gathered from your ID. This information is never saved, only processed.
VRChat securely processes this information into a hash, and saves the hash. We then destroy the source data, and tell Persona to destroy their version of the data, too. This ensures that while we can verify your identity when needed, your sensitive personal information is never saved in any systems for longer than necessary.
[NEW] Why do you need the hash?
The hash helps us manage age verification securely while protecting your privacy. Here’s what it allows us to do:
-
Detect duplicate IDs: When someone submits a verification, we compare it against our existing hashes. If we find a match, we know that ID has been used before and can reject the verification.
-
Enforce bans: We can check if an ID was previously associated with a banned account, preventing banned users from verifying new accounts with the same ID.
-
Enable multiple accounts: We can allow users to have more than one verified account using the same ID. Previously, this would have required keeping your full ID data with Persona. While this is not planned for initial launch, we are considering the feedback that you have given us.
By using hashes instead of storing actual ID information, we can provide these security features while minimizing the sensitive data held by any party.
This approach maximizes the effectiveness of Age Verification, minimizes the risk of storing sensitive data, and gives us the flexibility to adjust our policies based on community feedback.
How long is my data kept?
VRChat keeps your birth date for as long as we need it to provide you with access to the platform and enforce our Terms of Service. Since your birth date must be provided in order for you to agree to our Terms of Service as well as for Age Verification, your birth date will be retained as long as your account is valid or until you request removal of your account or information.
[The following paragraph has changed with the hashing changes.]
VRChat will retain the hash of your ID data as long as your VRChat account remains verified.
The data used to generate the hash is discarded as soon as the hash has been calculated.
We tell Persona to delete your personal information as soon as the Age Verification process has been completed.
Can I request the deletion of my data?
[The following response has changed with the hashing changes.]
At any time, you may request that VRChat delete your verification data and/or your birth date.
Deleting your birth date will render your account unusable until you agree to our Terms of Service again and provide a birth date. A VRChat account must have a birth date attached to be usable. It will also revoke your Age Verified status until you verify again.
You may also request that we delete the Age Verification hash from your account. This will revoke the Age Verified status from your account until you complete Verification again.
You may also request that Persona delete your ID data at any time. This will not affect your Age Verification status.
Who holds my data and what do they do with it?
VRChat
If you have registered an account and successfully logged into VRChat, you have already provided us with your birth date. Entering your birth date is required to agree to the Terms of Service the first time you register to use the platform.
Going through Age Verification will validate your birth date, allow access to Age Verified instances (assuming you are 18 or older), and issue the Age Verified and 18+ Age Verified badges. We will continue to use birth date data to ensure compliance with the age requirements in our Terms of Service as dictated by COPPA and other laws and for internal analytic purposes as described in our Privacy Policy.
[The following paragraph has changed with the hashing changes.]
VRChat receives your birth date and the minimum amount of personal data from Persona possible to calculate a sufficiently unique hash. All other data is not sent and is firewalled from VRChat. Images of IDs, selfies, and facial scans are not transmitted to VRChat.
You may view our Privacy Policy and US State Data Privacy Laws Disclosure, which discloses how we collect, process, share, and store your data.
Persona
[The following section has changed with the hashing changes.]
Persona does not hold your data long-term. Once your verification has been completed, we tell Persona to destroy your validation data as soon as possible.
Persona’s privacy policy outlines the type of data they collect and how they use it.
Persona receives no information about you from us.
Whenever possible, VRChat will choose to minimize the amount of data retained and the duration for which it is retained, as long as it doesn’t impact the effectiveness of our Age Verification program.
How will Persona use my data?
Persona is obligated to only use your data to provide identity verification services for VRChat and is expressly prohibited from selling it or sharing it for another purpose.
I’m not comfortable with Persona as a provider.
We believe that Persona is the best provider for us.
We’re constantly evaluating the performance, security, and reputation of our partners, and if we need to change, we will.
I would like to see changes to this system.
We plan on iterating on our Age Verification system based on feedback from the community.
If you’d like to express your opinion, provide feedback, or express concerns, please visit our feedback page here. We’ve created a board specifically for Age Verification.
Additions as of December 3, 2024
If deleting my personal information with Persona doesn’t affect my Age Verification status, why can’t you delete it immediately and automatically?
Asked by @lackofbindings, @ayymang, @Orion, @Fairplex, @Smash-ter, @SylviaCrisp
[The following answer has changed due to the hashing changes.]
We tell Persona to destroy your personal information as soon as verification has been completed.
Do I have to create an account with Persona?
Asked by @irishfemboi
No, you do not. The verification flow is anonymously tied to your VRChat account via a unique generated ID, and does not require creating an account with or signing up with Persona.
Persona cannot tie verifications directly to publicly available VRChat user IDs.
Why does Persona hold onto my data?
Asked by @Fox_McCloud, @lackofbindings, @PeachiPrism, @Corbent
[The following answer has changed due to the hashing changes.]
We tell Persona to destroy your personal information as soon as verification has been completed.
Is my ID deleted after a certain period from Persona’s servers?
Asked by @Fox_McCloud, @Zekk
[The following answer has changed due to the hashing changes.]
We tell Persona to destroy your personal information as soon as verification has been completed.
Will a selfie or a video always be required to validate my ID?
Yes. Right now, we require a selfie check to ensure that the person doing the check is the owner of the ID.
If I use another form of ID, may I validate an additional account?
Asked by @nidonocu
Alternate IDs of the same person may or may not trigger duplicate detection.
Which countries are supported by Persona?
Asked by @kawashirov, @docteh, @extrymas, @camilla_May
Persona supports over 180 countries and adds support for more over time.
Persona may not be available for those living in territories and areas affected by US sanctions. We cannot make an exception in these cases, as these sanctions also affect VRChat, preventing us from providing service to those territories.
Why does VRChat retain my birth date after you’ve validated my age?
Asked by @ShingenPizza
VRChat requires your birth date to ensure compliance with our Terms of Service and to enable the Age Verification system. This also means that Age Verification is about validating a birthdate, not simply validating whether a user is over 18 or not.
Additionally, a user that Age Verifies before their 18th birthday will automatically be able to enter 18+ instances on their 18th birthday.
VRChat also uses user birth dates for the purposes described in our Privacy Policy.
If you have registered an account and successfully logged into VRChat, you have already provided us with your birth date.
What happens if my verified birth date differs from the one I provided when I agreed to the Terms of Service?
Asked by @Zekk, @syncpulse
We will correct the birth date on your VRChat account to the verified birth date provided on your ID. Don’t worry, no other actions will be taken.
Where do I go to delete my data from VRChat or Persona?
Asked by @Zekk, @reverse, @Yin
To request the deletion of data from your VRChat account, contact our support team.
To request deletion of your data from Persona, please view their Privacy Policy under the Choice and Control of Personal Data section.
How soon will Age Verification roll out to a wider audience?
Asked by @Salbug, @TEXT, @Aaravos_love
It is difficult to give dates or estimates on release timing, as any statement of an estimate or internal target is often read as a promised release date.
We’re comfortable stating that Age Verification will be released to a wider audience when we’re confident in the system and our testing results.
When will limited Group testing start?
Asked by @TEXT
We plan on starting testing before the end of the year.
What’s the difference between Age Verified and Verified 18+ badges?
Asked by @kazy
Age Verified means you have completed Age Verification.
Verified 18+ means that you have completed Age Verification and are 18 or older.
By default, no badge is shown. If you are Verified and 18 or older, you can select either badge.
Neither badge grants anything other than a visual display. Accessing Verified instances depends on completing Verification and being 18 or older, and does not depend on your badge being displayed.
What other content or systems will be affected by Age Verification?
Asked by @ZidaneTOrnitier, @WarpedKarma6471, @JuJuGames
We have not announced plans to integrate any other content or systems with Age Verification, other than our intent to integrate Content Gating with Age Verification.
What if I lose access to my account or swap to another account?
Asked by @Pepperpop
Loss of your account may be solved by contacting VRChat support.
Privacy regulations such as the GDPR and CCPA contain exceptions for business needs related to platform security or moderation. In case of an account loss due to moderation action like being banned, VRChat and Persona will retain data necessary to enforce this ban in compliance with privacy regulations. You may not use the same ID to validate another account if the first account is banned.
In case of an unrecoverable account loss or a willful account switch, you may delete your Age Verification data from the first account by contacting VRChat and Persona. After that point, the first account will become unverified, and you can use your ID to verify your new account.
Is it possible to fake the badge via a modified client?
Asked by @_Pup
It is impossible to fake a badge’s display on your profile from another user’s point of view by using cheats, hacks, or modified clients.
If both users are using cheats, hacks, or modified clients, it is possible to fake any badge. At that point, the code running is no longer ours, and any behavior is possible.
As a reminder, creating or using modifications to the VRChat client violates the VRChat Terms of Service.
Is Persona’s biometric system affected by gender-affirming treatments such as HRT?
Asked by @Reiva
We do not have exact details on Persona’s biometric systems, but modern image-based FRT (facial recognition technology) relies on facial markers. Some research indicates that gender-affirming treatments like HRT may affect facial geometry, although there is not an established conclusion that these changes affect FRT in a major way.
Surgical or traumatic changes to facial features may affect facial recognition.
If verification fails for these reasons, please contact VRChat or Persona support.
When will Content Gating be affected by Age Verification?
Asked by @HighScoreHerozz
We don’t have an ETA for this feature.
I have questions about the Content Gating implementation.
Asked by @Duskstar_Shine, @gotofinal, @JuJuGames
We don’t have answers regarding our Content Gating integration with Age Verification yet. We’ll circle back later with answers.
Do we have access to Persona customer support?
Asked by @Mondocat
Yes, you may access Persona customer support here.
Do you have plans to work with additional Verification partners?
Asked by @Utami_Hasegawa
We do not currently have plans to work with additional Verification partners.
How do we trust that you have configured Persona’s API correctly to only deliver birth date?
Asked by @otter_oasis
[The following answer has changed due to the hashing changes.]
VRChat has configured our connection with Persona such that we only receive the birth date and the information required to generate the Age Verification hash.
Persona receives no information about you from us.
Access to Age Verification dashboards and databases for VRChat and Persona is heavily controlled and limited to the minimum per industry standards and regulatory requirements.
As with any service, some level of trust from all parties is required to operate.
Are VRChat employees subject to the Age Verification system?
Asked by @PurposeUnknown
Yes. VRChat employees must adhere to the system on their personal accounts.
VRChat reserves the right to grant administrative accounts the ability to bypass instance restrictions for safety, security, and development purposes. These accounts are not used for personal usage and are monitored and controlled.
Can an instance owner invite someone who is not verified, overriding instance settings?
Asked by @PurposeUnknown
No, an instance creator cannot override Age Verification for a specific user.
Does the DPA require that Persona treat every user with GDPR-like levels of data protection?
Asked by @agenderwitchery
Our DPA obligates Persona to protect user data as required by applicable laws such as GDPR, which requires industry-standard protection based on factors such as current industry norms and the sensitivity of the data.
What if my verified age is incorrect?
Please contact VRChat Customer Support if you need to update or correct your age after completing verification.
What document types are supported?
A government-issued photo ID is required for verification. This includes passports, driver’s licenses, state ID cards, and residence permits.
Additions as of December 10, 2024
How do I know if my group was selected for the beta?
Asked by @SenpaiPanda
If a group is selected for the beta, the current group owner will receive an email containing instructions on how to use the system.
This email will be sent to the email address used to register the VRChat account.
Can I, as an individual, request participation in the beta?
Asked by several
No. The beta test focuses on Groups, and requests from individuals will not be accepted.