Ad Tech & Identity · Identity verification / age assurance (B2B) · Structural / no discrete incident
Persona
Headline
Persona runs selfie-and-ID checks and facial age estimation for consumer apps, so people meet it mid-signup without choosing it.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Persona runs selfie-and-ID checks and facial age estimation for consumer apps, so people meet it mid-signup without choosing it. In February 2026 researchers examining Discord's age-verification flow found a publicly exposed Persona frontend (2,456 files) they said described watchlist and politically-exposed-person face matching, 'adverse media' screening and up-to-three-year retention of IDs, faces and device fingerprints. Persona said the exposed domain was an isolated test environment with 'zero customer data' and disputed the researchers' characterizations; no exposure of personal data was confirmed. Reports say Discord then dropped Persona for age verification (not confirmed from Discord this pass).
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-16
Primary source. www.malwarebytes.com/blog/news/2026/02/age-verification-vendor-persona-left-frontend-exposed — Unverified - heuristic first draft.
Terms
Arbitration
Not applicable to consumers — Persona acts as processor; consumer terms are those of the app using Persona.
Data sharing
Processes facial geometry from selfies and ID images, ID numbers, device fingerprints and IP on behalf of client apps. Policy: no sale/share; discloses to service providers (hosting, IDV, fraud providers); AWS, Google Cloud, MongoDB. Feb. 2026 frontend exposure reported by researchers; company says no personal data exposed.
Fees and billing
None identified (no consumer billing relationship).
Contacts
Privacy contact. idv-privacy@withpersona.com; dpo@withpersona.com; https://withpersona.com/privacy-portal
Legal notice. Persona Identities, Inc., 981 Mission Street #95, San Francisco, CA 94103 (privacy policy contact address; registered agent not verified).
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| Security news (Malwarebytes, updated) · 2026-03-13 www.malwarebytes.com/blog/news/2026/02/age-verification-vendor-persona-left-frontend-exposed | whole row | Unassigned | confirmed | “this entire domain has never had any federal customers and has zero customer data” Quote basis: not recorded. |
| Company processor privacy policy · 2026-04-09 withpersona.com/legal/privacy-policy | whole row | Unassigned | confirmed | “Age Estimation Scan Data is deleted immediately as soon as an outcome has been determined.” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://withpersona.com/legal/privacy-policy | Not fetched yet | NOT CONFIRMED |
| Terms of service No URL recorded | Not fetched yet | NOT CONFIRMED |
| Website https://withpersona.com | Not fetched yet | — |
| Primary source https://www.malwarebytes.com/blog/news/2026/02/age-verification-vendor-persona-left-frontend-exposed Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: CA. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |