Still for a pure age verification DoB and your picture is enough > think of when you buy alcohol or go into a club, all they check is your DoB and that its you on the picture.

Sure you could make the argument "but they can't verify the validity of the ID" which is correct (they could check for the holographs and other security measures that make it harder to fake an ID but lets ignore that since they could be fake) but that means they should provide a reasonable method to verify it that doesn't require the processing of too much data.

Recital (39) of the GDPR:

"Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means."

Using eID or at least using a service which supports eID is fully within reason.

Dominik 25kt The GDPR does not require the use of eID (electronic identification) systems for compliance—let's be clear about that. Instead, it focuses on robust data protection measures, secure authentication methods, and clear processes for handling personal data.

Recitals in the GDPR are not legally binding; they exist to guide the interpretation of the Articles. The Articles themselves provide the legal framework, such as Article 25, which prioritises data minimisation while allowing for consideration of factors like implementation costs and the state of the art. Supporting eID would demand significant development costs for Persona, exceeding what is already an effective system based on ID recognition and Optical Character Recognition (OCR). Additionally, international entities rarely adopt eID, demonstrating it’s neither a universal standard nor a practical requirement.

Putting aside that the very start of Article 25 clearly states there is more to the picture then what you're putting forward, if you have genuine concerns about the processes used by Persona, the best course of action is to raise these directly with Persona or consult your country’s Data Protection Authority. Challenges regarding non-support of eID have likely been addressed and dismissed before—and will likely continue to be dismissed in the future.

It’s genuinely surprising that some people believe they’re raising a novel argument here, ignoring the fact that Persona is already used for age verification by some of the biggest games and entities in the world, including Roblox. This isn’t uncharted territory, and the arguments presented are neither new nor indicative of a GDPR violation—they’ve been thoroughly examined and discarded as anything more than optional best practice. Now if we want to talk about best practice, then let's do that, but let's have the common-sense decency to call it what it is.

since most parts of your answer is just AI written its not really worth my time, I could talk with ChatGPT myself but I'll still reply to one point since its the one that made me think its AI

> Recitals in the GDPR are not legally binding; they exist to guide the interpretation of the Articles.

If it tells you how you should interpret a law it kinda is part of the law.

for example:

I tell you every time I say blue I actually mean green, I ask you to get me something blue (I mean green as you know) and you decide to get me something actually blue > you got me the wrong thing because you interpreted it wrongly even though I specifically told you what I mean.

Thats why the Recitals exist, to make it clear what is meant.

Dominik 25kt I am asserting that Recitals do not address the detail or the substance of legislation, and thus whilst it is possible to find relevant quotes in the Recital, the actual Articles will contain the detail that is omitted from a Recital and thus carry much more weight in any judicial sense.

Importantly, no one would ever be accused of violating a Recital, and a simple Google of 'Recital in Law' will give you numerous references to this point and the further point I was alluding to is that I won't debate a Recital when there is very clear specific provisions in Article 25 that allow a data controller to factor in 'cost of implementation' and 'state of the art' into decisions surrounding how and when they minimise data collected.

Unless you're countering that specific argument, you haven't really got much of a leg to stand on, and the laziness of your reply (Specifically the copying of MyFedora's ChatGPT accusation) shows you're grasping at straws.

Chirping_Cat Are you actually arguing that sending a picture of my ID is state of the art? I dismissed that since its just AI slop and I though no one can actually believe that.

Whats next? sending my physical ID by mail is also "state of the art"?

And for "cost of implementation" countries have published apps so its easy for everyone to verify that the other person is 18+, I show you a QR code > you scan it > you get the info that I'm 18+ and a picture of me so you can verify that i didn't just steal the eID from someone aka most of the work is already done.

Dominik 25kt No, I am not arguing that.

I am suggesting that supporting eID, or any Government-based digital identification platforms, to the full-extent required to deliver the privacy benefits they entail is uncommon at present, and not reflective of the current state of art used in age verification used by tech platforms. This is evidenced by the fact that only 41% of EU citizens used an eID in at least one of their online interactions in 2023... And this number does not imply exclusive eID use, meaning of that 41%, many would have also had non-eID interactions on the Internet, bringing the percentage of "exclusive eID users" down even more. (Source: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=E-government_and_electronic_identification ) - Why does this matter? Because it demonstrates that non-support of eID for identification, whilst not adhering to what is obviously a best-practice, does not make a platform an outlier in terms of data handling practices such as to constitute a GDPR violation. Which explains why the world's major verification platforms (Like Persona) aren't forced to support it yet.

Cost of implementation exists because VRChat requires a scalable (Read: Automated) way to ingest and validate that information, which speaks to custom development effort above and beyond what is readily available given that mainstream identification platforms (Like Persona) are clearly not supporting it yet.

But please, keep mentioning the red herring of the AI boogeyman rather than addressing the arguments: It's probably the most sense you've made in everything you've stated so far, despite how factually flawed it is.

Edit: Also the lack of any rebuttal to my response concerning Recitals is noted. Thank you for conceding on that point.

> is uncommon and not reflective of the current state of art used in age verification used by tech platforms

Except they are common just not with US based ones. (you might also wanna look at the definition of "state of the art" because it does not mean "whatever is commonly used")

> Cost of implementation exists because VRChat requires a scalable way

So adding a platform which supports it is not scalable?

And to sum up the whole conversation, we went from "they need the full uncensored ID because there is no other way to verify that its legit" to "there are other ways they are just too lazy to implement them and thats ok because most other US company is also too lazy"

Dominik 25k The fact that Non-EU organisations have not adopted eID is is still relevant on basis of the unique investment required to support eID, the extent their user base consists of European users covered by this process, the completely optional nature of the process, and the state of the art of Non-EU organisations. (Again, as per Article 25, all of these factors would counteract the argument that there has been violation of the GDPR.)

Let's be real for second: The reason that European entities support it is because they predominantly deal with and handle European customers. It makes sense for them to support this since it benefits more of their user base. Article 25 allows data controllers to make reasonable judgements on this basis and others, and again, no one is yet to argue the opposite.

Personally I would sum up the conversation as "VRChat has implemented the age-verification option that, on the whole, and having consideration for all the competing considerations (Such as global coverage, cost per verification, privacy and security, support team costs, ease of use, cost of implementation etc.) that best suits their business case. They have a clear rationale for collecting the information given the industry standard age verification process they are following, they have clearly communicated what the information collected is and what they do with it, will discard the information at the earliest possible opportunity, and in so doing are completely compliant with the GDPR. There is nothing in the GDPR that compels companies to spend money they may or may not have on every single data minimisation initiative in existence, there is nothing that mandates support of eID, and the start of Article 25 goes to great lengths to make clear that data minimisation isn't everything; There are other factors that must be considered."

That being said, I completely agree supporting eID would be excellent. It's a best practice, and I hope more platforms adopt it. However, this Canny post accuses VRChat of violating the GDPR. Hence my comments are focused on the accuracy of the that accusation, rather than whether eID adoption is a good practice. If the post had simply been titled "Support eID for Better Privacy," I would have supported it and moved on. Unfortunately, the phrasing used by the original poster and many respondents has brought us into this broader debate, and made the Canny more difficult to support.

I don't want to drag it on forever but just to point it out

> they have clearly communicated what the information collected is and what they do with it, will discard the information at the earliest possible opportunity, and in so doing are completely compliant with the GDPR.

They are not clear what not clear which data VRChat is collecting/processing, we know Persona collects everything on the ID you provide and "some" data is being passed on to VRChat to create the hash.

Also when I initially created the post they did not "discard the information at the earliest" the initial plan was to let Persona keep it forever (unless you request them to delete it).

Dominik 25kt It is safe to say from the FAQ and Tupper's video that:

1) The Full Name, DOB and the Unique Document Type (License, Passport etc) and Document Holder Identifier (Such as Passport Number or License Number) is being used to generate the hash. I can't see any more or less information than that being stored based on the information available, simply because this is the only information that would appear on every type of ID, and because adding further information makes it easier to re-use IDs across multiple accounts. (You have to keep in mind that VRChat has a vested interest to include as little information as possible in the Hash to help prevent dodging by country and address changes etc.) - In theory they could replace Full Name with Document Country, and that would be even better from a privacy perspective.

2) That the data is pulled from Persona via the API via HTTPs for the purposes of generating the Hash, and that this Hash is then stored in the database against the user.

3) That the raw data is discarded from Persona's systems at the completion of the verification process.

Whilst I accept your last point, given that this is a Beta system, I'm only going to debate what the system is currently not what it was, simply because there's no benefit contemplating what might have been given that... well... this is part of what Beta's are for, VRChat specifically invited this kind of feedback, and should be commended for listening to community feedback where that feedback is reasonable... not lambasted.

1) While I agree with you that no more data would be needed VRChat is not transparent about it, quite the opposite actually, they don't want to tell us > to quote Tupper "We don’t disclose the exact methods and data we use"

3) no, VRChat requests the deletion of the data after the process is done, which means in theory they could keep it for days or weeks (depending of which laws apply) and during that time they (Persona) could do whatever they want with that data.

Dominik 25kt

1) If that is indeed the case then I agree it is superfluous, have you got a source to link to that I can read? Obviously people will very easily figure out what is in the hash when they attempt to their ID on alts... both successfully and unsuccessfully, so it is completely pointless hiding what goes into it since the mere act of trying to verify multiple accounts will result in users reverse engineering what they're recording. (Tupper - VRChat Head of Community - Can you please provide some clarity on this point? Since there really is no apparent reason to hide that information)

2) They've stated in writing that the data is deleted at the end of the process, which is post-generating the Hash. The request is made via the Persona API, so it should be instant.

Chirping_Cat

> have you got a source to link to that I can read?

its in his reply from Dec 18 2024 that marked this thread as "complete", idk if i can directly link to it

ByteByte-Baxi When Easy Anti-Cheat (EAC) rolled out, there were skeptics who swore it would ruin everything and threatened boycotts. But guess what? The vast majority of players adapted, those who threatened boycotts got over it, and many came to like the change because it meant fewer clients and a better experience overall.

The same logic applies here despite the fire and brimstone you're painting out: Adults want spaces free of minors, and robust age verification is the way to get there... I wouldn't be investing money in Resonite or CVR on the assumption they're going to suddenly take off anytime soon.

Chirping_Cat EAC was not asking for your full un modified government documents get out of my face with this bullshit comparison

ByteByte-Baxi I don't think you understood my point. What you're saying is I reckon you're overestimating how many people are against this. If VRChat survived the EAC drama, it'll breeze through this without losing any real value.

I mean, only 52 people bothered upvoting this Canny in 15 days—that’s practically nothing. Compare that to over 20,000 responses on day one of the EAC rollout. Meanwhile, Resonite is still a ghost town, and VRChat’s going strong.

But hey, no need to worry about age verification when you’re playing solo on Resonite, right?