From July 8, 2026, Anthropic's Claude can ask some users to prove who they are with a government photo ID, a live selfie, and a facial scan. It is not Claude alone: identity and age verification is quietly spreading across the AI tools and online services people use every day. For founders, especially the many who run on consumer plans, it is worth understanding what is being collected, who holds it, and how to keep your business out of the awkward parts.
What is changing
Anthropic updated its privacy policy so that, in certain cases, it can ask a Claude user to verify their age or identity through a third-party service called Persona. Depending on the check, that can mean handing over a photo of a government ID, a selfie photo or video, and a face-geometry template, the digitized map of your face that counts as biometric data. The verification is handled by Persona, which holds the ID and selfie rather than Anthropic. Importantly, this is not a blanket "scan your face to log in" rule: it targets a subset of accounts, those flagged for possible fraud or policy violations, people appealing a suspension, and routine platform-integrity checks. But if you are flagged, the choice is to verify or lose access.
Why privacy-minded people are uneasy
The discomfort is reasonable and worth stating plainly. Biometric data is not like a password: you cannot change your face if it leaks, and facial-geometry data carries specific legal protections in places like Illinois, whose biometric privacy law (BIPA) is the toughest in North America. Anthropic's policy does not commit to a clear deletion timeline for verification data, and any third-party identity provider can become a target for breaches or a recipient of government data demands.
There is also a question of who is behind the verifier. The company running these checks, Persona, counts Peter Thiel's venture firm Founders Fund among its major backers. Thiel also co-founded Palantir, the data-analytics company long criticized for its government-surveillance work, and digital-rights groups have questioned handing biometric identity data to a Thiel-backed firm. To be fair, Thiel is an investor, not an operator, and Persona is a separate company from Palantir. But when a vendor will hold your team's photo IDs and face scans, who funds and governs it is a fair question to ask, the same due diligence you would apply to any supplier that touches sensitive data.
It lands on consumer plans, where most founders start
Here is the part that matters most for small businesses. The verification applies to Claude's consumer plans, Free, Pro, and Max, while the business tiers (Team, Enterprise, and API) are exempt. In theory the clean answer is "use a business tier." In practice, most founders we talk to do not start there: you sign up for Pro or Max to get going, run real work through it for months, and only formalize tooling later. So a meaningful number of small-business owners are using exactly the plans now in scope, and telling them to "just upgrade to Enterprise" on day one is not realistic. The honest takeaway is to know you are on an in-scope plan, understand what a verification request would involve, and plan your move to a business tier as the company grows, both for the exemption and for the data-processing agreement and admin controls that come with it.
What a founder or small business should do
You do not need to panic or abandon AI tools. You need to be deliberate:
- Keep client and sensitive data out of consumer AI accounts regardless of verification, a personal Pro account is not where your customers' information belongs.
- Know what you would be consenting to before you verify: what is collected, who holds it, and for how long. If a tool will not say, treat that as a signal.
- Move company use to business or enterprise tiers as you grow, where you get a contract that governs your data, admin oversight, and exemption from consumer ID checks.
- Treat "who handles our identity data" as vendor due diligence, the same as you would for a payment processor or a payroll provider.
Identity and age verification is becoming normal across online services, driven by fraud, child-safety laws, and regulation. That is not inherently sinister, but it does mean your business is being asked to hand more identity data to more third parties, and the companies that stay calm are the ones who decided in advance what they will and will not share.