Anthropic has added an identity verification requirement to its privacy policy, and the policy’s defining feature is what it does not say. The updated terms, published in June and taking effect July 8, state that users may be asked to prove their identity “in certain circumstances” without specifying what those circumstances are.
The mechanism, when triggered, requires a government-issued passport or driver’s license photo, a selfie photo or video, and a face geometry template derived from that image. Illinois classifies face geometry templates as legally protected biometric data. Anthropic says it will retain a record of whether the user passed verification and met applicable age thresholds.
TechCrunch first reported the policy change, which Anthropic spokesperson Michael Aciman framed as a narrow update to the appeals process. Anthropic’s Thariq Shihipar posted on X that the change reaches only “a small subset of users,” limited to people whose accounts have been flagged short of a full ban. Neither Shihipar’s post nor Aciman’s statement defined what a flag looks like, what volume of users falls into that subset, or what operators building on the Claude API should tell their own users if those users receive a verification prompt.
The absence of specifics is itself the story. Anthropic has tens of millions of monthly users, per TechCrunch’s earlier reporting. “A small subset” of that base could still represent a substantial number of people. The company has listed permissible uses for the data, including fraud prevention, terms-of-service enforcement, and security incident investigation, but those categories are broad enough to describe almost any platform trust-and-safety scenario. Operators integrating Claude into their own products have no published criteria to use when predicting whether their users might face a verification prompt.
Anthropic uses Persona, a San Francisco-based identity verification company, as its checking provider. The investor behind Persona is Founders Fund, the firm Peter Thiel started, and Thiel also holds a stake in Anthropic. Discord selected Persona for its own age-verification rollout earlier this year, then reversed that decision after user backlash specifically tied to Persona’s Thiel connection.
The data retention question is unresolved. Anthropic told TechCrunch that it controls how long Persona holds user identity documents, but Anthropic’s spokesperson did not say when that data is deleted. For comparison, Roblox, another Persona customer, deletes users’ images immediately after processing. Anthropic has made no public commitment to a comparable timeline. Persona servers, like any U.S.-based provider, are subject to government data demands.
Shihipar’s public statement noted the policy is unrelated to the Fable or Mythos model rollouts. That clarification suggests Anthropic anticipated the question of whether identity checks might gate access to specific model capabilities. The company has not, however, said what platform behaviors do trigger the verification flow.
The broader context matters. Anthropic is navigating an ongoing standoff with the Trump administration. The Department of Defense designated Anthropic a “supply chain risk” after the company declined to allow its technology for mass domestic surveillance or fully autonomous weapons. Trump officials subsequently pressured Anthropic to pull its latest cybersecurity models. Closer user-identity tracking could be one response to those pressures, though Anthropic has not made that connection publicly.
For businesses building on the Claude API, the July 8 date is a concrete deadline with unresolved operational questions. If a flagged user of a Claude-powered product is prompted for a government ID, the product team currently has no documented way to predict when that happens, explain it to the user, or appeal it on the user’s behalf. Any team serving users in Illinois or other states with biometric data laws should get legal review of this policy before July 8.
Reporting by Zack Whittaker, TechCrunch, published June 22, 2026.
