LinkedIn users attempting identity verification may be unknowingly handing sensitive personal data to Persona Identities Inc., a company that distributes information to government agencies, credit bureaus, utilities, and mobile providers.

The issue came to light last week when a Zurich-based privacy researcher known as “Rogi,” who covers surveillance capitalism on his blog The Local Stack, published his findings. 

Rogi made the discovery after completing LinkedIn’s identity verification process, earning the platform’s coveted blue checkmark in just three minutes.

“Then I did what apparently nobody does,” he said. “I went and read the privacy policy and terms of service”—only to discover those 34 pages of disclosures didn’t stem from LinkedIn.”

It turns out that users seeking verification are redirected to Persona Identities Inc., a San Francisco-based tech company that provides customized identity verification platforms for businesses and organizations, helping them combat fraud, stay compliant, and manage user onboarding.

In the article, Rogi highlighted the extensive range of personal data Persona can access. 

According to him, the company collects users’ full names, passport photos, selfies, facial biometric data, NFC chip information from passports, nationality, sex, birthday, age, email, phone number, physical address, IP address, geolocation, device type, MAC address, browser and OS version, and preferred language.

Persona reportedly shares this data with 17 subprocessors and a network of partners, including AI companies such as Anthropic, OpenAI, and Groqcloud.

Rogi also claims that the platform uses uploaded identity documents, including passports, to train AI systems.

“They use uploaded images of identity documents — that’s my passport — to train their AI. They’re teaching their system to recognize what passports look like in different countries,” he said. “They also use your selfie to ‘identify improvements in the Service.’ The legal basis? Not consent. Legitimate interest. Meaning they decided on their own that it’s fine.” 

After Rogi’s The Local Stack post on LinkedIn and Persona went viral, Persona co-founder and CEO Rick Song addressed the report in a LinkedIn comment.

“No personal data processed is used for AI/model training,” Song said. “Data is exclusively used to confirm your identity.”

He also noted that all biometric data is deleted immediately after processing, and all other personal data is deleted within 30 days. 

Song denied that AI companies such as OpenAI and Anthropic are subprocessors used to verify a user’s identity, even though those companies appear on a Persona webpage listing the company’s subprocessors.

“The referenced subprocessor list is the superset of subprocessors used across all customers, which is unfortunately misleading,” Song said. “Our customers select which products are used, which determines which subprocessors are used. We are adding a clarification to this list to make this clearer in the future.”

Persona’s presence on leading platforms, including Roblox and Discord, which use it for age verification, has placed the company under the microscope. Another recent report from a security researcher claims Persona performs “269 individual verification checks” on Discord users.