I’m going to do my best to respond to the Age Verification/Persona questions. I’m not going to be responding line-by-line to every question, as I don’t think that would necessarily be helpful. Instead, I’m going to try to get at the heart of the matter.
First: I get why there’s so much anxiety around this.
To say that we’re in a tense moment of time would be an understatement. Given that VRChat is a platform where a lot of people go to be themselves – whatever that happens to mean for them – a certain degree of privacy is necessary.
Second: A lot of what I’m about to say is me reiterating stuff from our Age Verification FAQ. Some time has passed though, and it’s possible not everyone has read through all of it. So here we go!
Persona is a company that provides many services to many different clients, all with varying needs.
Take a peek at their website and look at the “Solutions” tab.
Persona provides out-of-the-box tools that are relatively easy to use and integrate for their clients. This is because, for example, a lot of customers looking for a “KYC” (Know Your Customer) solution all generally want the same sort of solution, that maintains compliance in a certain way (for whatever industry they are in).
Persona also provides its clients with a lot of customization, as well as powerful tools to make sure that what they want to happen is happening. They offer a lot of flexibility – more than most providers. You can take an off-the-shelf solution from them, yes, or you can be very specific about what you’re looking for.
One of the engineers who setup our integration was graciously enough to take some time out of his day to explain what this looked like to me.
Here’s what he had to say:
We are not using Persona’s default settings, so if anything you have heard about their default functionality contradicts what we’ve said, it’s because we’ve set it up to work differently.
I have set up our implementation to explicitly remove all verification data after a verification inquiry succeeds, fails, or expires. I’ve also verified on their dashboard that the verification data is being removed.
This actually causes problems for us sometime, which some of our users have noticed. For example, because this data is deleted, when a user has a problem with verification (say, a certain sort of ID), it’s almost impossible to troubleshoot, as we don’t actually know what type of ID they were using. Persona, also, can’t help… as they can’t see it either, as it is deleted immediately even if verification fails.
It’s also worth noting that Persona receives no information from us about you or your VRChat account.
We generate a custom ID for the sake of verification, which tracks the progress of the verification process. Once Persona sends us the relevant information attached to that ID, it’s hashed, we complete the process, then all verification data is deleted.
This process ensures two big things: we don’t store any data related to your verification (nor do we receive any images of IDs or face scans) and Persona doesn’t know who you are in VRChat.
Finally, Persona handles data according to terms they agree on with their customers (including us!). What folks have seen “in the wild” are numbers that often equate to the maximum length that they are comfortable holding data, not the additional limits their customers might have with them.
This is also why we said this in the blog post, where we announced Age Verification:
Persona is obligated to only use your data to provide identity verification services for VRChat and is expressly prohibited from selling it, sharing it, or using it for another purpose.
Finally, I’d just like to say that, when something does happen that’s big news in the tech space, we’re always taking a look, too. We’re always keeping tabs on things. We, after all, are as plugged in as you are, and want to make sure that we’re providing the best product for our users.
To some extent, I hope that the fact that we’re verified is us showing our money is where our mouth is. We trust the system enough that we use it. We’re a step beyond dogfooding at VRChat. 