Age verification is no longer a future problem: it's here, it's messy, and it's hitting every platform you use. And this past week, the conversation exploded when security researchers cracked open the inner workings of Persona, the same company that handles age verification for VRChat.
Persona is the San Francisco-based company that processes your government ID and selfie when you verify your age on VRChat. They also work with OpenAI, Roblox, Reddit, and until very recently, Discord.
In mid-February 2026, researchers discovered Persona had left 53 megabytes of source code (2,456 files) sitting on a publicly accessible U.S. government-authorized server. No hacking required. It was just there.
What they found inside went far beyond age checks. The code revealed 269 distinct verification checks, including facial recognition against watchlists, screening for politically exposed persons, adverse media checks across 14 categories (including terrorism and espionage), and infrastructure to file reports directly with U.S. Treasury's FinCEN. What's marketed as a "teen safety" tool looks a lot more like a surveillance platform.
Discord had been testing Persona for UK age verification and had planned a global rollout by March. After the exposure, backlash was immediate: users announced mass migrations to other platforms, and TeamSpeak reported maxed-out servers from the influx.
Discord's CTO admitted they "missed the mark," confirmed Persona "did not meet the bar" for their privacy standards, and delayed the global rollout to the second half of 2026. Making things worse: Persona is funded by Peter Thiel's Founders Fund. Thiel is the co-founder of Palantir, a surveillance tech company that works with U.S. government agencies including ICE.
It also came out that Discord's previous age verification partner was breached in 2025, exposing 70,000 users' government IDs. Pattern, anyone?
Here's the thing: VRChat uses the same company. Since January 2025, VRC+ subscribers have been able to age-verify through Persona, with the same ID upload and selfie liveness check.
VRChat says they only receive your verified date of birth and never see your ID photos or selfies. That may be true. But Persona's own platform has the capability to run those 269 checks, screen against watchlists, and retain biometric data for up to three years. Whether those features are active for VRChat specifically is unclear, but the infrastructure exists.
This matters even more because Content Gating is coming in the first half of 2026. Avatars and worlds tagged with mature content will require age verification to access. Public instances must be suitable for a general audience. Events are already moving. Furality, one of VRChat's largest conventions, now requires all attendees to be 18+ and age-verified by June 2026.
Age verification is shifting from optional to essential for the full VRChat experience.
Already verified? Your data was theoretically processed and deleted. VRChat retains only your date of birth. Keep an eye on updates.
Considering it? It's a personal call. Verification will increasingly be needed for mature content, events, and age-gated instances. Weigh the access benefits against your comfort level with the process.
Avatar creators? Start thinking about content tagging. When Content Gating rolls out, mature-tagged avatars will only be visible to verified users.
Everyone? Stay informed. Discord dropping Persona could pressure other platforms, including VRChat, to re-evaluate their partnerships. The community deserves transparency, and VRChat owes users a clear statement on whether Persona remains the right partner.
The Persona exposure is a wake-up call. Age verification isn't going away, but the companies handling your most sensitive data need to do better. Stay informed, make conscious choices, and push for the platforms you use to be honest about how your data is handled.
Have thoughts? Join the conversation on our Discord or drop a comment below.
