Why is it that everyone’s noticing that known ERP groups/communities are being given testing for it? Hmm??
2 Likes
Something else popped into mind: What’s stopping malicious actors from attempting to compromise 18+ verified accounts with intention to sell on to people who refuse to verify their age, and potentially minors looking for other means to get into adult spaces? Should those wishing to display their 18+ verified badge be required to have 2FA enabled to ensure that never happens? Ideally, anyone who has been 18+ verified should make every effort to secure not only their VRChat accounts from being compromised, but also their e-mail address to prevent password reset hijacks. Enable 2FA everywhere, people. It’s annoying, but it protects you.
why are we required to join a to verify
If you’re 18 do you get the Verified +18 tag or do you have to be 19
Where exactly is the hash generated?
I’m a bit confused by this as from a security standpoint I would have expected it to be generated by Persona and then given to VRChat, but the information in the email you get when verifying makes it sounds like VRChat is the one generating it.
If VRChat is generating it, what information are they being given to do so?
Is that information being stored at any point? Or is it only being stored in memory, then processed and immediately deleted once the hash has been generated?
2 Likes
If the only purpose of providing our PII to Persona is for them to confirm we are over 18 and provide a hash to VRC for validation, then why does VRC need to retain our actual date of birth? This is more dangerous than retaining our legal name, because while thousands of people may share it, none will have our exact date of birth. That’s the one piece of PII that is used by databrokers and Dark Web doxxers to identify us. As a content creator, I have to ask why VRC needs to retain our full birthdate?
3 Likes
First of all, sending a selfie with ID card to some kind third party platform is sketchy af.
Also why this data is being kept on their servers? Most services that require or just give an option for age verification don’t ask for someone’s id but for example use their credit card (which is not perfect either but you can use something like Privacy to create a Virtual Card only for this purpose) and what’s more important - right after verification is successful or not all this data is being deleted for security reasons, not kept for unknown reasons or to attract potential hackers to steal them.
One more thing…
Dear vrchat devs, are you perhaps trying to avoid responsibility for a potential leak of users data? You know, in case something like this happens you can then just say “It was not our fault! We don’t store this data! Persona does, so it’s their fault!” and then we as users would need to deal with Persona.
4 Likes
i have the badge, would it be possible to open a group where only 18+ verified people can join the group? or is it just instances
also, like roblox can you make worlds that only 18+ people can go in?
Also asked by @Dragon, @AlexanderSummer
VRChat has always collected a user’s birth date as part of our registration process. We trust that users provide an accurate birth date, but do not verify it at that time.
Obtaining and storing your birth date is required to adhere to certain regulatory requirements and to enable the Age Verification system. A simple flag that reads “user is over 18” would be insufficient for our purposes and requirements.
Also asked by @MikeBonez3356
Users under 18 may undergo Age Verification. They will only get the “Age Verified” badge, but not the “Age Verified 18+” badge. They will also be unable to enter “Age Verified 18+” instances.
Also asked by @ThatOneKitsune, @ModxVoldHunter, @Venompapa, @_clutch
With the ongoing beta test, you must:
- Be a member of a participating group
- Obtain the “custom link” from the Group’s administration
This group-centric method is only for the beta test and will not be how we deploy the system more widely in the future.
Please watch for notifications, in-app articles, or other updates regarding Age Verification to learn how to go through the process once we release it more widely.
Persona requires an unobfuscated ID to ensure that the ID is valid, unmodified, and properly represented.
VRChat stores your birth date and a hash calculated from the properties of your ID. This hash is similar to password hashes. Due to the security we have implemented and the nature of the data being hashed, this hash is effectively irreversible and cannot be turned back into its original data.
VRChat never stores any data related to ID verification other than what was mentioned above.
Persona does not store any data long-term. They are required to delete your data as soon as the verification process either succeeds or fails.
VRChat is paying for the Beta. We have not announced it yet, but we have plans to offset the costs of this service when we release it more widely.
Also asked by @Venompapa
Persona does not share data between its customers. As such, a Persona-powered verification for another service will not affect the verification process with VRChat.
Yes. Users can lie about their age at registration. While this violates our Terms of Service, it happens, and we must account for it.
Not at this time.
Only the current badge visibility is available to other users, even through API calls.
We do not reveal your Age Verification status unless you select to do so by changing your badge visibility.
Using a government-issued photo ID is required to ensure the validity, trustworthiness, and security of the Age Verification process.
Other verification forms, such as charging a credit card are insufficient for our purposes.
Users who harass others will be moderated. Please report cases of this to the moderation team.
Instance owners are encouraged to use the Age Verification system to lock their mature instances from users under 18 using the native system, sidestepping this issue.
An email was sent to the current registered email address of the current group owner informing them that their group was brought into the beta, and includes instructions on how to use the system.
Roughly speaking, our roadmap is to release Age Verification to more users after our Groups-centric beta.
The wide release of Age Verification will not be necessarily tied to Groups, and the “groups handing out a link” method is only being employed for the beta.
Please refer to this answer in our OP.
Persona retains no data about you after you have completed the verification process.
Also asked by @p4riah
Please refer to this answer in our OP.
Persona is obligated through our DPA to only use your data to provide identity verification services for VRChat and is expressly prohibited from selling it, sharing it, or using it for any other purpose.
We have enabled all supported locations for Age Verification. Persona supports over 180 countries, regions, and territories worldwide, and adds more over time.
The amount of time you have played VRChat has no impact on the Age Verification system.
We do not have plans to implement such a system, but please post your feedback.
We have not announced plans for further age restrictions for instances.
Persona is obligated by our contract and DPA to delete data when we request for them to do so, which we do immediately following a successful or failed verification.
VRChat will continue to employ and operate relevant teams to address these issues through ongoing updates, improvements, policies, procedures, and moderation practices.
If a user is disincentivized from verifying their age because they are worried that, when they get banned, their alts will be affected, we consider this a moderation positive.
Our hope is that users do not wish to be banned.
Age Verification is not required to use VRChat. We do not have plans to change this policy.
We will work with feedback, reported incidents, and other inputs to improve our UX and UI when required to reduce user confusion.
Trust Level has no impact on Age Verification.
VRChat monitors regulatory guidance in all areas where we operate and we update and modify our service to adhere to new regulations as they apply.
No, your birth date is never revealed to other users.
This is not planned to be an option.
To start, Group instances of any type.
There is a checkbox to turn on the feature when creating a Group instance.
We are considering opening this feature to additional instance types, but this is not currently planned. Please post your feature request on our feedback boards.
We have not announced plans for a feature to lock content behind Age Verification, and the current system only locks instances. Please post your feature request on our feedback boards.
Thank you for all the questions. We have answered many questions in this thread, exceeding the standards set by our peers and other platforms offering the same verification service.
If you have further questions regarding Age Verification, please consult with the OP and the contents of this thread. Many questions are already answered here.
Upon or soon after the full release of Age Verification, we will condense these questions into a FAQ provided in our knowledgebase and in a blog post.
We will continue to monitor this thread for new questions, but answers may not be posted here. Further information, changes, and updates to this system will be delivered via Dev Updates, Video Patchnotes, in-app Articles and notifications, and other communication methods.
1 Like
Trusting the user input, which is to say you were collecting noise. To facilitate of-legal-age check you, in fact, do not require more than a binary state. But let’s consider this answered.
What about everything else asked there? Pinky promise is not enough.
Most concerning is how you’ve ignored every single instance of people asking about your plans in regards to enabling citizens of countries not properly handled by Persona to get their age verifications. Does quarter of the world just get bent because Persona won’t handle them? Brazil, China, Russia, and so on.
1 Like
Will you be adding a birthday feature with this? Say when the person’s birthday comes around, can the person have a badge on their profile for the day to show that?
But the most important question still wasn’t asked - does age verification means that ERP is now legall? 
Can there be ways to verify with out a id if a person doesn’t have one due to to irl problems but could use a birth certificate or a all about me certificate?
so if someone were to put a random age on there account would they not be able to verify?
one more question, The idea is to have rooms with people with verified age and/or verified +18, in this case, in these +18 rooms is ERP and other things allowed?
Will people see your age or will it only say this person is 18+, when you get verified?
Is there every a chance you will make it where only 18+ can only friend 18+?
Question 1: Can an expired ID be used, or does the ID have to be unexpired?
Question 2: Is data shared between VRChat and Persona encrypted in transit through protocols like https plus any potential additional encryption, or is data sent in plain text?
Question 3: This is not fully clear to me - Does VRChat receive PII (personally identifying information) from Persona to calculate a hash based on this, or does Persona calculate the hash and send the hash to VRChat?
The government ID I want to provide isn’t listed for any of the ID options. Since it’s still considered legal ID under Canadian law, what do you plan to do, in general, for ID’s that are federally/government provided but are not on the list?