Alternative Age Assurance Options to Persona
SMarseille
Dear VRChat Team,
I am writing to express my strong desire to support and participate in VRChat’s mature, age-gated communities, while urging the team to implement alternative age assurance methods that do not rely on Persona.
While I completely understand and support VRChat's need to comply with global regulations and protect the platform, many dedicated users—including myself—have deep-seated privacy concerns regarding Persona. Given their past data handling controversies, public code exposures, and the widespread community pushback that led platforms like Discord to cut ties with them, I am entirely uncomfortable providing them with my government ID or biometric camera data.
Many adult players want to verify their age but feel forced to choose between their digital privacy and accessing 18+ spaces. I would love to see VRChat introduce less invasive verification alternatives, such as:
- Privacy-first vendors: Partnering with alternative, strictly audited age-estimation providers like Yoti that process scans entirely on-device and instantly destroy pixel data.
- Non-biometric verification: Implementing alternative checks, such as temporary credit card authorizations or mobile carrier verification, which prove adulthood without requiring facial tracking.
VRChat has always thrived because of its community's trust. Offering a choice in how we verify our identity would allow privacy-conscious adults to safely enjoy the full VRChat experience without compromising their personal data.
Thank you for your time, your hard work on platform safety, and for listening to community feedback.
Sincerely,
Smarseille
Log In
Hackebein
Changes are already on it's way: https://hello.vrchat.com/blog/june-2026-safety-update
SMarseille
I do want to add, that I am a dutch citizen.
By law it is illegal for Persona to collect BSN (which is on the ID/Passport) and is forced to be required to obfuscated when said entity is not government, or for basic needs such as healthcare, banks and mobile phone contracts.
Consent does not apply for the use of the BSN
"Sometimes, organisations are allowed to use someone's personal data if that person gives consent for this. This does not apply for the BSN. Organisations are only allowed to use the BSN if a law says that they are permitted to do so. If it is not in the law, then it is not permitted. Not even with consent."
And my last 2 cents why I do not trust Persona, and so should nobody:
The Harsh Reality: U.S. Law Beats GDPR
Because Persona is a U.S.-based company, it is legally bound by American laws that can completely override European privacy protections.
- The U.S. Cloud Act: If a U.S. federal agency issues a national security request or a warrant for data, Persona is legally required to hand it over—even if that data belongs to a Dutch citizen living in the Netherlands.
- The "Gag Order" Problem: Under U.S. surveillance laws (like FISA), the government can force a company to hand over data and simultaneously issue a legally binding "gag order." This means Persona could be forced to keep or hand over data, but would be legally banned from telling you or the Dutch government about it.