Age Verification Feedback

Per the updated FAQ for the announcement of Age Verification, I would like to suggest a hard limit of at least 1 or at most 2 alts who are eligible for the same age verification. People may have alts for various reasons, some being that they may not want people who know their main VRC account name (especially if that name exists outside of VRC on other platforms) and may not want to engage with the more hardcore gated content (cough18+STUFFcough) for fear of other users maliciously looking them up and then harassing them on other platforms or even irl. I realize that may be an extreme example, but I can imagine I am not the only one who has their VRC name as their other socials and tries to keep it as professional as possible especially those that are creators. And while you could just say... "Well. Then just verify your alt account." ...and I could just do that, but what if in doing so I lock my main account off from my favorite worlds and or avatars should those world/avatar creators put their creations behind Age Verification gates. I apologize in advance if this was hard to follow, I'm not the best at articulating my words, so I hope this made some sense... I would just greatly appreciate being able to keep my main and an alt with the same amount of access and not feel like I have a baby gate in my way on one or the other despite being a fully grown adult. -_-

As of reading a recent post in June regarding age Assurance it has come to my attention that I find many things regarding the situation to be an issue, as well as problematic not just for users, but for the community as a whole. I wish to detail a list of concerns and problems that I see, and that I wish to be addressed in some form. The system as it stands, seems to disregard a somewhat terrible design decision that makes changing, and adjusting avatars that are currently uploaded that are counted as sexually suggestive very tedious, and tiresome. The website, by in large, should have a way to view avatars differently, so they are not in a list, as well as being able to bulk tag avatars. As a user with multiple uploads private or not having to roll through my list and tag everything because I may be punished, makes me feel less compelled to go through the wave of 100s of avatars just to secure my account security due to a fault in design. As I see it, even adding a "Tag all" button on the website, would mean that users with large quantities of either Non Sexually suggestive, or sexually suggestive avatars will be able to adjust and bulk change much of what they have uploaded. I believe this change would benefit however only for this moment, and is sort of a solution that may only be viable now, but could be used in future. Tagging All avatars, while there is no way to tag non sexually suggestive avatars as non sexual, makes me think that there should be something in place to do 'non sexual'. My reasoning for it is simple; You can easily ensure all avatars untagged prior to a certain date (01/01/2025 i think is best,) be marked as Sexual or non sexual (However VRCHAT chooses to see fit). This allows users to go through and mark only a select couple they may need, ensuring the player base is able to use whatever they do or don't tag because there was a helpful system in place. If this however is not a great solution, I think my third point my be quite positive. When a user loads up an avatar they own for the first time after the change, a pop up could appear, allowing users to mark the avatar as Non sexually suggestive, or sexually suggestive. This also can allow future uploads to include this and make avatar uploading easier on the user and the current player base. By allowing us to tag it in game, this prevents the punishment, while also providing VRChat with the security they were asking of it's users. Obviously, this does not include public avatars, which should, by in large, be tagged prior to the change to ensure there is no issue. This does however protect a majority of the player base who may not even know this change is coming and don't have a good way to manage it, as with reasons stated above. As I said too, this change means that those who upload and merely just forgot to make a tag will be notified in game and will be able to fix this issue. This is why I suggested that a 'non sexually suggestive' tag be implemented, so each avatar is properly able to be checked and no longer receive such a pop up. Avatars from beyond the date of the change, should no longer be able to be made public without these tags too, providing more security, so users do not retroactively make private sexual avatars available. Make a clearer, concise list of what is considered sexually suggestive. One of the major issues I found while reading the guidelines, is that the guidelines for what is and isn't Sexually suggestive does have some things that can be left to interpretation. This is a massive issue, because if we, the creators, read such guidelines and deem our content appropriate because as we understood it, it was, and the team for VRChat disagrees, we are punishment due to an error in conveyance. As such, more examples and stricter wording would help regarding this situation. This can also be confusing, due to the idea that something that is 'sexually suggestive' is agreed to be, by all people, and all sexual orientations. Better guidelines will help everyone, and again, will improve future content creation for all users. I hope that these ideas could be implemented, even if it's just one of them, as they each make an impactful difference to the community and creators as a whole. I hope this is considered as things roll out.

Use a different method or business to age verify. Persona has had multiple data leaks and lies about how they store and use data. They do not delete it they keep it and sell it. They are a safety risk and a moral failing.

They scan your ID against 250+ sources, not to mention keeping a record on you for years after you verify, while having your whole ID and SO many data breaches.

VRChat has determined Persona can be trusted with a photo of your face and government ID. Persona is a VC-backed (arguably "tech bro") San Franciscan tech startup that's only existed since 2018. They operate out of a shared space behind a bar: https://maps.app.goo.gl/t5ebyhr9oTUhupMf9 Their privacy policy says (as I read it) that they explicitly have permission to take your personal information (selfie, photo of your government ID) and store it for years, and can and will send it to "vendors, agents...companies we've hired to provide customer service support..." and to "law enforcement [and] other government agencies." They say they'll use your personal information "to understand you and your preferences to enhance your experience and enjoyment" and for the purposes of "marketing, including to communicate with you about new services, offers, promotions, rewards, contests, upcoming events, and other information about our services and those of our selected partners..." and for "advertising, including display [sic] advertising to you..." Their privacy policy site also uses clickjacking to prevent you from copying the text of their privacy policy: https://withpersona.com/legal/privacy-policy These doesn't seem like the actions of a legitimate and trustworthy company, and there aren't enough guarantees that you won't be literally doxxing yourself. PII is extremely valuable and there's an entire industry of brokers that facilitate the sale and transfer of people's personal information--not to mention the risk of hacking, accidental disclosure, or a new and untrustworthy company being sloppy or reckless. These days AI can train off a photo of your face, and scams and identify fraud are extremely common. Personally, the only times I've had to provide a photo of myself holding an ID are for once-in-a-lifetime financial transactions. Never for a video game or social media. VRChat is willing to take the chance of making this de-facto-mandatory (i.e., the community normalizes it and it results in a greatly degraded experience if you don't comply)? The ask is a severe imposition and an invasion of privacy without adequate concern that the chosen data broker is trustworthy. Even the announcement incorrectly claimed your PII would be handled in accordance to the GDPR, but the company is actually based out of California, where regulations are far less strict, and fines far less burdensome.

To put this plain and simple to start: The idea of verifying one's age to gain access to more secure and moderated groups and instances sounds like a good idea at first. However, your current method of age verification (Persona, and frankly any 3rd-party ID Verification service) is, and has already proven to be, an incredible risk to everyone's data privacy and cybersecurity. (Now onto the lengthy part) Persona has been recorded gathering more information other than Age such as: name, address, gender, marital status, and similar demographic details, Social Security Numbers, IP address, device type, your device’s operating system, browser, cookie and device identifiers, and other software including type, version, language, settings, and configuration, geolocation data such as city, state, and country, etc. Persona also has ties to the government data analytics company Palantir. Persona has also been caught building profiles on users and sharing said profiles with the US government and government organizations such as ICE, even having a flagging system to flag users that seemed suspicious. It was also discovered that 269 different checks were used for verification, including things like phone carrier queries and death record matching, and with their privacy policy hiding these checks under vague terms like "public government documents". So this all means that even though Persona says that all data is deleted within the first 3 days (or in some cases, up to 3 years), that data has already been passed off to third-party partners and the US government and does not get deleted. To further prove my point, Other age verification services have had multiple mass breaches of personal information, such as pictures of IDs, Biometric Face Scan data, and more. For example: Infutor, which had a massive data breach where 676,798,866 unique American citizens (including deceased persons) had their data exposed, including full names, date of birth, addresses, cities, state, ZIP codes, phone numbers, and social security numbers. IDMerit also had about 1 billion personal records leaked throughout the world. I am completely unwilling to put my personal data and cybersecurity at risk for a little logo that tells others that I'm over 18. But I believe that there are possible, safer alternatives for age verification My first thought for alternatives is, of course, manual age verification checks performed by VRChat's safety team. This is obviously never going to happen because this would take forever, hiring enough staff members to review all of these age verification requests would be too expensive, and this also comes with security risks. So my next Idea is credit card-based age verification. This is, in my opinion, the best of both worlds. The majority of countries across the world require you to be at least 18 years of age to get a credit card, and currently, you need to have an active VRC+ membership to age-verify. There could very well be a system where if the user pays for a VRC+ membership using a credit card, then they become automatically eligible for the age-verified status. This is personally how I would like to verify my age. I don't currently have a credit card, but I am willing to wait until both I have a credit card and until you get a system like this put in place. But until that day comes, I will never age-verify using Persona or any other ID Verification service. I hope you take everything that I have said into serious consideration moving forward.

I've been an active user for 5+ years, primarily in the rave scene. over the past while, more and more sfw venues I've attended for years have adopted age verification, which I won't use because I'm not willing to hand over that kind of personal information for a social platform recently my favorite event age-gated itself right before my birthday, which was the last straw for me I don't want to leave, but I'm currently making plans to move to another platform. I hope there's an alternative path being considered that doesn't require giving up my privacy because I'd like a reason to stay thanks for reading

It will always be worth restating no matter how many times or in how many ways it's said. Privacy isn't just some word bad people hide behind. Trust and safety should apply to all users. I'm not going to presume VRChat's need to perform identity verification as part of their strategy. I'm just throwing my opinion in that the level of data sharing is excessive for the goal of age verification and creating a reasonably safe environment. Laws can change or be broken. Policies can be quietly ignored. People can be put at risk through no fault of their own. I'm of the opinion that platforms like VRChat have a responsibility to implement these systems in a way that maximizes and maintains privacy. VRChat are the ones that want to own the platform after all - rather than letting users self-host or federate. The level of trust that can be put into the 'trust me bro' assurance that PII or other personal data artifacts are handled appropriately is paper thin. VRChat's choice of partner has (rightfully) come into public view on multiple occasions for exactly the wrong reasons. VRChat has become an important social outlet for me. My group has taken to mostly use 18+ instances regardless. So now I become a burden if I'm to be included (not a great feeling). I can only speculate other groups are the same. Meaning verification is all but necessary to even participate and will probably get worse once content gating is in. Making the verification process a matter of coercion rather than purely of consent. I sincerely hope VRChat comes up with a more appropriate solution.

Please update the terms of service section 8.10 to include age and date of birth. We now have a working solution to age verification and whether instance owners agree or not, a persons age and date of birth should no longer be something a user is required to disclose. This should be included with the anti-doxing language that already includes name, address, and government id. Nobody should be allowed to require the disclosure of ANY personally identifiable information and should solely be relying on the in-game mechanism already provided by vrchat.

As an Individual who has played VRChat for many years and a high advocate for online privacy. I have concerns about the movement where age verification is going to. Reasoning against ID verification: People should NEVER give their ID out to any online service. There's no reason to have your government ID linked to an online account. I understand that people can argue that only a hash of your ID is stored and so on. But it's not about what they claim to store. It's that you have to give it to them in the first place. Now for an alternative: Parental accounts. An easy way that has been successfully implemented by many companies. E.G. Windows Live Family Safety (Microsoft family features) The use of parental accounts to create accounts for children, being able to monitor and control what they can view. It shouldn't be the responsibility of third parties to block content. It should be parents responsibility to set up the right and safe constraints to have their kid safely browse and use the internet. Thank you for reading. Edit: Fix some spelling mistakes.