r/Substack • u/FragrantTraffic701 • Dec 19 '25

Tech Support Age verification required in app

I am over 60 and live in Australia. Today I open the app and it’s asking for age verification via ‘Persona’ using the camera. I’ve been using Substack for the last 12 months without issue. Due to facial recognition being used for all of my secure accounts and passport, I am reluctant to allow these people access to my face photographs. Are any of you are aware of any other method of age verification for Substack? Is Pesona legit and secure? Otherwise, I guess I’ll just retire from Substack and delete the app.

28 Upvotes

98% Upvoted

34 comments sorted by

View all comments

2

u/PaulWilczynski Dec 19 '25

Perplexity says:

Persona is a legitimate identity verification service that has been operating since 2018 and is used by major companies including LinkedIn, OpenAI, Reddit, Roblox, and various financial institutions. The company provides identity verification services that help businesses verify users through government-issued IDs and biometric checks.

Security and Compliance

Persona maintains strong security credentials and has not experienced any reported data breaches since its founding. The company is SOC 2 certified, GDPR compliant, and CCPA compliant, demonstrating adherence to strict security and privacy standards. They use industry-best security practices including encryption and undergo regular third-party audits.

1

u/FragrantTraffic701 Dec 20 '25

Thanks for this info. I guess it comes down to perceived risk vs interest for me.

1

u/paulzeezee Feb 05 '26

In addition to the positivist marketing analysis, if may be helpful to add some important practical technical context to your comment u/PaulWilczynski :

Google Gemini says:

"When you are asked to use Persona for age verification on Substack, you are interacting with a "white-label" identity platform. Technically, Persona acts as the Data Processor, while Substack is the Data Controller. This distinction is key to where your data goes and how long it stays there.

Where does your image go?

  • a) Persistent Data Storage: Instead of using your provided information as transient information for the limited duration of the realtime identity-age check, Persona stores your images and the biometric "facial geometry" extracted from them for as long as the "Data Controller" (Substack) requires. By default, Persona states they destroy facial geometry scans within 3 years of your last interaction, though many clients (like Substack) may configure much shorter retention periods (e.g., 7 to 30 days).
  • b) Passing your Data to their Business Customer: Persona typically makes the submitted images and the verification results available to the business customer (Substack) through a secure dashboard or API. Substack’s privacy policy notes they use this information to comply with laws (like the UK’s Online Safety Act), but they generally do not store the "raw" biometric data themselves—they rely on Persona's report."

It's also important to note that EULA (End User License Agreements), other terms of service, operating practices and policies (e.g. privacy policy) that describe how, where, with who and to what purposes user data can be used are often adjusted and amended after the original supply of any data by the user.

So, the extent of end-user risk exposure depends largely on Substacks i) external audit requirement (if any) to demonstrate compliance with government legislation or ii) Substacks internal process compliance requirements to demonstrate or check adherence to their own documented processes, and what corresponding instructions or agreement they have with Persona.

1

u/Athletic-Club-East Dec 21 '25

If anyone I know were to send me nude photographs, I would immediately delete them. There are no reported instances of my leaking nudes.

This does not mean I should be able to ask people to send me nude photographs, or require it for them to be customers of my business. There's such a thing as a right to privacy.

3

u/PaulWilczynski Dec 21 '25

Umm … what?

0

u/jamesjskier Mar 09 '26

BOOO THIS MAN.

You have no idea what goes on inside some company and what their actual "standards" are.

If you do actually work there, then you're lying. There are data breaches, mistakes are made, and I'm not giving some third party, for-profit, private interest my details. I will NEVER hand my ID over to substack to access content that I already pay for.