Age Verification Now Available for VRC+ Subscribers
Age Verification is now available for all VRC+ subscribers! Age Verification is a new system that allows users to verify who they are via Persona, a third-party service.
Verified users receive an optional special marker on their bio to let others know they’ve gone through the process. Users who are 18 or older can also display that on their profile with an additional marker, if they choose to do so.
Verified users aged 18 or older can also create Age Verified Group instances — if their group permissions allow it. If you're a group owner or admin, be sure to enable the "Create Age Gated Instances" permission for the roles you want to have this ability!
The age verification process utilizes Persona to verify your government-issued ID and compare it to your likeness. VRChat will receive and process text extracted from your ID, and will not receive any images or face scans. This information is used to generate an irreversible hash, which is saved.
All extracted text from your verification process other than your birth date is deleted, and is never stored on our servers.
If you have VRC+, you can complete Age Verification right now by clicking here!
For further questions, you can check out the FAQ below.
Age Verification FAQ
What is Age Verification?
Age Verification is a system that allows users to go through a process to validate their age. Once a user has validated their age, they can choose to display a badge that shows “Age Verified” or “Verified 18+” (provided they are 18 or older). They can also choose to display no badge at all. The visibility of this badge can be changed at any time.
Group Instance creators can then lock their instances to Verified 18+ users, creating an adult-only space. Your badge’s visibility on your profile does not affect your ability to access these instances.
What are the benefits of Age Verification?
Access to Age Verified instances
Access to the Age Verified badges, including the “Verified 18+” badge if you are 18 or older
Who is Persona?
We’re partnering with Persona, an ID verification company based in San Francisco. Their existing customers include Roblox, Reddit, Coursera, OpenAI, Instacart, Square, Lime, and more.
Persona has a Privacy FAQ that can be helpful to read and a CCPA amendment that addresses the CCPA’s requirements.
Who holds my data, and what do they do with it?
Going through Age Verification will validate your birth date, allow access to Age Verified instances (assuming you are 18 or older), and issue the Age Verified and 18+ Age Verified badges. We will continue to use birth date data to ensure compliance with the age requirements in our Terms of Service as dictated by COPPA and other laws and for internal analytic purposes as described in our Privacy Policy.
VRChat receives your birth date and the minimum amount of personal data from Persona possible to calculate a sufficiently unique hash. All other data is not sent and is firewalled from VRChat. Images of IDs, selfies, and facial scans are not transmitted to VRChat.
You may view our Privacy Policy and US State Data Privacy Laws Disclosure, which discloses how we collect, process, share, and store your data.
Persona does not hold your data long-term. Once your verification has been completed, we tell Persona to destroy your validation data.
Persona’s privacy policy outlines the type of data they collect and how they use it.
Persona receives no information about you from us.
Whenever possible, VRChat will choose to minimize the amount of data retained and the duration for which it is retained, as long as it doesn’t impact the effectiveness of our Age Verification program.
How long is my data kept?
VRChat keeps your birth date and the non-reversible hash of your ID data as long as your account is valid, or until you request removal of your account or information. This information is attached to your VRChat account.
The data used to generate the hash is discarded as soon as the hash has been calculated.
We tell Persona to delete your personal information as soon as the Age Verification process has been completed.
What do I have to submit to Persona?
An unobfuscated (not blurred or redacted) government-issued photo ID is required for verification. This includes passports, driver’s licenses, state ID cards, and residence permits. Please consult with Persona to see the available list of valid documents.
In addition, they may require a “liveliness check,” which involves using a phone camera or webcam to scan your face. This is done to ensure that the person validating is the person who owns the ID and that you’re a real person, not just someone who generated an ID or grabbed one from their parents.
VRChat does not receive images of IDs or face scans from Persona.
How will Persona use my data?
Persona is obligated to only use your data to provide identity verification services for VRChat and is expressly prohibited from selling it, sharing it, or using it for another purpose.
Do I need Age Verification to play VRChat?
No, you can use VRChat without verifying your age.
You will not be able to access Age Verification features without completing verification.
If my VRC+ subscription expires, will my Age Verification status change?
Age Verification is permanent even if your VRC+ subscription ends.
Why does this cost money? Why do I need VRC+?
Age Verification is not cheap! Our focus in implementing this was on choosing a trusted partner who could provide verification for the large majority of our users as easily as possible. That, however, means it costs us money, so we can't just make it free for everyone. To control costs, we're currently expanding to just VRC+ members.
What happens if my verified birth date differs from the one I provided when I agreed to the Terms of Service?
We will correct the birth date on your VRChat account to the verified birth date provided on your ID. Don’t worry, no other actions will be taken.
Can I use the same ID to verify multiple accounts?
You cannot verify multiple accounts using the same ID. Once an ID has been used to verify one VRChat account, it cannot be used to verify other accounts (alts).
Locking IDs to a single account benefit VRChat in several ways:
Increased trustworthiness of Age Verified Accounts
Reduced potential for fraud and abuse
Reduced access to Age Verified instances for malicious users
Increased account value, which dissuades malicious behavior
Reduced implementation, maintenance, and complexity
We’ve been talking to group leaders and we’re aware of several cases where this restriction will cause problems, particularly using accounts for logging, cameras, etc. We’re working with them to try to solve this issue.
Which countries are supported by Persona?
Persona supports over 180 countries and adds support for more over time.
Persona may not be available for those living in territories and areas affected by US sanctions. We cannot make an exception in these cases, as these sanctions also affect VRChat, preventing us from providing service to those territories.
How does Persona ensure that minors cannot bypass Age Verification?
Persona employs checks that effectively prevent misrepresentation during the verification process.
However, no process is foolproof. As such, our Trust and Safety team will analyze reports and follow up when verification is suspected to be falsified.
No age verification process is immune to fraud, but the process Persona employs is far more effective than any other form available.
Can my ID information be removed from VRChat/Persona servers?
Yes. At any time, you may request that VRChat delete your verification data and/or your birth date.
Deleting your birth date will render your account unusable. In order to use the account again, you must agree to our Terms of Service again and provide a birth date. This will also revoke your Age Verified status.
You may also request that we delete the Age Verification hash from your account. This will revoke the Age Verified status from your account.
We tell Persona to delete your ID data once verification is completed.
What is a hash?
A hash is a fixed-length string of characters that uniquely represents data of any size. It is created through a mathematical function that transforms the input consistently but non-reversibly.
Hashes store passwords and other secure information in cases where you need to validate that one value matches a provided value, but you don’t want to store the original value itself.
For example, when you enter your password on a website, the website does not store your password. Instead, it hashes your input and compares it to the stored password hash. This means that the website never has to store the password itself.
Hashes used for these secure purposes are non-reversible, meaning you cannot “undo” the calculation to get the original string if you have the hash. This is a fundamental property that makes hashes useful for security – they work like a one-way street, allowing you to verify data without exposing the original content.
While attempting to reverse a hash is mathematically possible, this process is prohibitively time-consuming and computationally expensive. To protect against such attacks, security best practices include techniques like “salting” and “peppering.” A “salt” is a random value added to the secure data before hashing, ensuring that identical passwords produce different hashes. A “pepper” is a secret value added to all secure data, providing an additional layer of security.
Calculating the hash itself is done carefully, ensuring that sophisticated attacks against the hashing system cannot reveal personal information.
When we receive verification from Persona, they send us text extracted from your ID. This information is never saved, only processed. VRChat never receives images or face scans from Persona.
VRChat securely processes this information into a hash, and saves the hash. We then destroy the source data, and tell Persona to destroy their version of the data, too. This ensures that while we can verify your identity when needed, your sensitive personal information is never saved in any systems for longer than necessary.
Why do you need the hash?
The hash helps us manage age verification securely while protecting your privacy. Here’s what it allows us to do:
Detect duplicate IDs: When someone submits a verification, we compare it against our existing hashes. If we find a match, we know that ID has been used before and can reject the verification.
Enforce bans: We can check if an ID was previously associated with a banned account, preventing banned users from verifying new accounts with the same ID.
Enable multiple accounts: We can allow users to have more than one verified account using the same ID. Previously, this would have required keeping your full ID data with Persona. While this is not planned for initial launch, we are considering the feedback that you have given us.
By using hashes instead of storing actual ID information, we can provide these security features while minimizing the sensitive data held by any party.
This approach maximizes the effectiveness of Age Verification, minimizes the risk of storing sensitive data, and gives us the flexibility to adjust our policies based on community feedback.
For press or media inquiries, please contact press@vrchat.com
We’re hiring! Check out open positions on our site
