I am sorry, but this is a massive issue. I hope more people express similar concerns, but I am really uneasy about this.

For one, the Vendor, Persona, appears to be very shady in its data privacy, retention, and security. For a company wanting to know so much about you, they do not give you the same courtesy. This is a company that appears to be doing everything to get into the market quick, which tends to be at the expense of real security and real robust systems. LinkedIn users have been complaining about the reliability of their verification service for months now. If this company seems to not even prioritize the reliability of their verification service, how much worse do you think everything else is?

For two, this puts users at risk. This should be point one, but it appears to be less important to the community at present. To get to the point, this platform has many members of the queer community. It is awful timing that VRC is rolling this out in the wake of a recent US election of which LGBTQ+ human rights are under threat. One data breach of Persona which leaks any data about LGBT members can be life-threatening. Once it is out there, it is out there. Persona seems to be OK with this due to their massive data collection, and so does VRC based on the disinterest in alternative solutions. Data breaches happen, especially easy lucrative targets like an insecure data harvesting company burning VC money. It is never a matter of if, but when a breach will happen. The only things Cybersecurity can do is mitigate the damage and make it harder to acquire the target. Of which, Persona does not care to consider or implement due to the lack of US-based regulations forcing them to, putting profits above human decency.

For three, this age verification system is way too broad in what it collects. If we were to entertain that a photo and government ID are needed for the community's desired age verification, the system should only be looking at confirming A. the ID is the user’s and B. the birthdate is over 18 years ago. After that, everything should be deleted. An ID is a big deal, and despite the US’s lack of privacy regulation, should be considered a “hot potato” to handle. A company should be very afraid when working with this data as a screw up could cost the company majorly. I do not understand why VRC goes one step in the right direction by only storing birth date on their end, but agreed to let Persona collect as much data as it wants from your ID, picture, and everything else they can get their hands on in the process.

This feels wrong. Something feels fishy and I am afraid of a future headline that will read “Persona suffers massive data breach and now you all are screwed...again, and after the other major data breach of SSNs and addresses.” The fact I see many users on VRC are willing to fork over so much information to “avoid kids” in a 13+ game in the process is disheartening. This is just a slow boil of increasing data harvesting that will continue to isolate and put pressure on the ones of us who will hold out and reject giving this data out so that we relent on our values in order to participate in what few communities exist for us.

We don't need this system to gather together and share experiences, content, and joy. We can demand more, and reject this authoritarian, surveillance-capitalist company.