Persona
Persona Identities, Inc., headquartered in US. Website: withpersona.com. Methods offered: photo id, facial age estimation (face scan).
verified 18 October 2026
Retention, as published by Persona
Applies only to Reddit. Not a vendor-wide default.
“Persona deletes all of your personal information, including any images if collected, immediately after the verification process ends.”
Quoted from help.withpersona.com; checked 18 October 2026. Period as stated: Immediately after the verification process ends (Reddit deployment only).
Retention statements by service
Statements may cover different services, data types, dates or exceptions. Different periods are not necessarily contradictory. A statement for one service is not a default for another.
| Deployment | Method | What the deployment states | Provider statement and scope |
|---|---|---|---|
| Character.AI | Facial age estimation (face scan) Primary source |
“Any biometric data or ID submitted is automatically and permanently deleted within 7 days. Character.AI does not have access to your submissions at any point.” Quoted from support.character.ai, dated 14 July 2026; checked 18 October 2026. Held by the vendor. Period as stated: Deleted by Persona within 7 days (Character.AI’s statement). Notes: Character.AI’s data page: “Character.AI does not collect or store any personal data submitted during age verification. All submissions are handled entirely by Persona, our trusted third-party identity assurance partner.” “Most users will only need to complete a selfie — no ID required.” Its FAQ: “Our service provider Persona processes your information to verify your age, identify fraud, and for quality assurance. Any biometric information is deleted within seven (7) days.” Its troubleshooting page (11 September 2026): “Your selfie must show your real, natural appearance”; verification can be completed on any device by scanning a QR code. |
Applies only to Reddit. Not a vendor-wide default. The provider quotation above applies only to reddit. No applicable provider-wide default has been verified for this row. |
| Character.AI | Photo ID Primary source |
“For those users who do get prompted for an ID, it’s collected by Persona, not C.AI. Persona is a reputable third-party provider with strong safety and security controls. And they only keep the IDs they collect for one week.” Quoted from support.character.ai, dated 1 August 2026; checked 18 October 2026. Held by the vendor. Period as stated: ID kept by Persona for one week (Character.AI’s statement); its data page says “within 7 days”. Notes: Character.AI’s data page: “A government-issued ID is only requested as a final step if Persona is unable to confirm your age from the selfie alone.” Its FAQ: “During the age verification process with Persona, some users are required to provide a government-issued ID based on the results of the initial face scan. In this case, an accepted form of ID is required to continue. Without a valid ID, the verification process cannot be completed and the account cannot move forward.” Its troubleshooting page lists driver’s licence, passport, passport card, identification card, consular ID, certificate of citizenship, permanent residence card and immigration visa, says “The image must be of a physical ID, not a digital or electronic copy”, and “there is no alternative to submitting a selfie or government ID if you are prompted to do so.” |
Applies only to Reddit. Not a vendor-wide default. The provider quotation above applies only to reddit. No applicable provider-wide default has been verified for this row. |
| ChatGPT | Facial age estimation (face scan) Primary source |
“Persona handles age verification and deletes your uploaded ID or selfie within 7 days after verification.” Quoted from help.openai.com, dated 14 October 2026; checked 18 October 2026. Held by the vendor. Period as stated: 7 days after verification. Notes: Live selfie taken with a phone or webcam. OpenAI's page: “OpenAI does not receive your ID or selfie. OpenAI only receives your date of birth or an age prediction.” |
Applies only to Reddit. Not a vendor-wide default. The provider quotation above applies only to reddit. No applicable provider-wide default has been verified for this row. |
| ChatGPT | Photo ID Primary source |
“Persona handles age verification and deletes your uploaded ID or selfie within 7 days after verification.” Quoted from help.openai.com, dated 14 October 2026; checked 18 October 2026. Held by the vendor. Period as stated: 7 days after verification. Notes: Government ID upload; Persona checks the date of birth and that the selfie matches the ID photo. OpenAI's page says ID numbers may be covered before uploading. |
Applies only to Reddit. Not a vendor-wide default. The provider quotation above applies only to reddit. No applicable provider-wide default has been verified for this row. |
| Facial age estimation (face scan) Primary source |
“Persona deletes all of your personal information, including any images if collected, immediately after the verification process ends.” Quoted from help.withpersona.com; checked 18 October 2026. Held by the vendor. Period as stated: Immediately after the verification process ends (Persona’s Reddit FAQ). Notes: Reddit receives only the estimated age. Reddit’s own page (updated 6 October 2026): “Reddit does not receive or store these photos; we only store your verified age and status. Persona deletes your information immediately after it’s processed.” |
Applies only to Reddit. Not a vendor-wide default. “Persona deletes all of your personal information, including any images if collected, immediately after the verification process ends.”Period as stated: Immediately after the verification process ends (Reddit deployment only) checked 18 October 2026 |
|
| Photo ID Primary source |
“Persona deletes all of your personal information, including any images if collected, immediately after the verification process ends.” Quoted from help.withpersona.com; checked 18 October 2026. Held by the vendor. Period as stated: Immediately after the verification process ends (Persona’s Reddit FAQ). Notes: Reddit receives date of birth from the ID. Reddit’s own page (updated 6 October 2026): “Reddit does not receive or store these photos; we only store your verified age and status. Persona deletes your information immediately after it’s processed.” |
Applies only to Reddit. Not a vendor-wide default. “Persona deletes all of your personal information, including any images if collected, immediately after the verification process ends.”Period as stated: Immediately after the verification process ends (Reddit deployment only) checked 18 October 2026 |
|
| Roblox | Facial age estimation (face scan) Primary source |
“Images and video used for Facial Age Estimation are deleted immediately after they’ve been securely processed.” Quoted from about.roblox.com, dated 7 January 2026; checked 18 October 2026. Held by not stated. Period as stated: Images and video: immediately after secure processing. |
Applies only to Reddit. Not a vendor-wide default. The provider quotation above applies only to reddit. No applicable provider-wide default has been verified for this row. |
| Roblox | Photo ID Primary source |
“Our service provider, Persona, will respectively delete your Biometric Data within 30 days after collection, unless required by law (such as a warrant or subpoena) to keep your Biometric Data for a longer period.” Quoted from en.help.roblox.com, dated 13 October 2025; checked 18 October 2026. Held by the vendor. Period as stated: Biometric data from ID and selfie: within 30 days after collection. Notes: Roblox’s Biometric and Facial Media Data Privacy Notice (effective 13 October 2025): “For identity verification, Persona captures a photo of your ID and a selfie.” and “Roblox may access the photo of your ID and selfie stored by Persona for training, product improvement, and compliance purposes. Roblox will not have access to the face geometry processed by Persona.” The 30-day period applies to biometric data from this ID route; facial age estimation images and video are covered by the newsroom statement on the row above. |
Applies only to Reddit. Not a vendor-wide default. The provider quotation above applies only to reddit. No applicable provider-wide default has been verified for this row. |
Reported customers
- Reddit 14 July 2025 biometricupdate.com
- Roblox 7 January 2026 about.roblox.com
- ChatGPT 14 October 2026 help.openai.com
- X and Grok 25 July 2025 ppc.land
- Character.AI 17 July 2026 support.character.ai
Certifications
- ACCS 1:2020 Level 2 (Age Estimation), Persona Selfie Age Estimation dashboard v2.2.1, valid to 12 Nov 2026 accscheme.com
The UK Age Check Certification Scheme (ACCS) registry lists certificates with their expiry dates; a certificate that has lapsed is recorded as such once the registry shows it.
Regulator actions and published incidents
Incidents
- — Exposed frontend: 2,456 files and 269 verification checks including watch-list/PEP screening reported by an independent researcher; Persona disputed the insecurity claim. The Oct 2025 Discord ID leak (~70k IDs) was via support vendor 5CA/Zendesk, not Persona. malwarebytes.com
Questions people ask about Persona
What does Persona say it keeps?
Applies only to Reddit. Not a vendor-wide default. "Persona deletes all of your personal information, including any images if collected, immediately after the verification process ends." (help.withpersona.com; checked 18 October 2026). Period as stated: Immediately after the verification process ends (Reddit deployment only). See each service’s own statement; scope, data type and exceptions may differ.
Is Persona certified?
Recorded certifications: ACCS 1:2020 Level 2 (Age Estimation), Persona Selfie Age Estimation dashboard v2.2.1, valid to 12 Nov 2026. Each links to its source on the page; expiry dates are as stated there.
Has Persona been fined or had a data incident?
Incident, February 2026: Exposed frontend: 2,456 files and 269 verification checks including watch-list/PEP screening reported by an independent researcher; Persona disputed the insecurity claim. The Oct 2025 Discord ID leak (~70k IDs) was via support vendor 5CA/Zendesk, not Persona.
Which UK services use Persona?
Recorded deployments: Character.AI, ChatGPT (OpenAI), Reddit and Roblox.
Sources for this profile
Changes to this profile
- — known_customers, sources: Character.AI added as a deployment from its own help pages (read 18 October 2026): “Character.AI has partnered with Persona, a trusted identity assurance provider, to handle all age assurance attempts.” Selfie first, government ID only if the selfie is inconclusive; Character.AI says “Any biometric data or ID submitted is automatically and permanently deleted within 7 days.” That figure is Character.AI’s statement, not a Persona page. manual
- — retention.quote, certifications, known_customers, open_questions: Persona’s Reddit FAQ re-read 18 October 2026: the “within 3 days” wording is gone; the page now says deletion is immediate after the verification process ends. ACCS registry re-read: Persona Identities Inc holds an age-estimation certificate valid to 12 November 2026. OpenAI’s help page (14 October 2026) names Persona, replacing the press source for that customer. (was: Persona deletes all of your personal information including any images within 3 days.) manual
Correct this entry
Vendors are welcome to correct their profile. Point us at the policy page and the wording is replaced with the quotation, dated. Send a correction. Nothing you send is published.