Where Your Selfie Goes: What Really Happens to Your Face and ID After an Age Check

After an age verification check, your selfie or ID isn’t usually processed by the website itself. It often goes to a specialist provider. After that, it all depends on the provider and how the website has set things up. Some setups give the website back only a result, such as “over 18.” Others let it access your original photos. What happens to those images afterward also varies. Some may be deleted shortly after the check, while others can be stored for years. Yoti, Persona, and Veriff, three major providers, publish different information about their practices. So who actually handles your photos, and how long might they be kept?

Fawad Ali

Oct 27, 2026

10 min read

Get the week’s best marketing content

How age verification works after you press “Verify”

Age checks became far more common in 2025. In June, the US Supreme Court upheld Texas’s HB1181, opening the door to similar state laws. In July, the European Commission began piloting an age-verification app in five member states, and on July 25, Ofcom started enforcing “highly effective” age assurance under the UK’s Online Safety Act.

How selfie and ID age verification works

Here’s how a typical check works, although some providers may skip certain steps:

You submit something to prove your age. That could be a selfie, a live video check, a scan of a passport, or a date of birth. The website selects the verification method. For instance, according to Yoti’s notice, its client chooses the age-checking method and determines whether it can see your actual age or just the result.
A provider performs the check. Many sites delegate this process to providers like Yoti, Persona, or Veriff. These providers generally process verification data on the website’s behalf, but they may also retain certain data for their own legally permitted purposes, such as fraud prevention, security, or legal claims. For instance, Veriff’s privacy notice explains that it primarily acts as a data processor for its customers but may act as a data controller for certain activities.
The system verifies your age. An ID check reads your date of birth. If the website needs extra security, your selfie may be compared with the ID photo. A liveness check is another way to make sure that a real person is present. In turn, facial age estimation skips the ID entirely.
The website receives a result. Depending on the setup, it may receive only an age confirmation or additional verification data.
Your original data is deleted, kept for a certain period, or archived. That’s where providers differ most.

Does the website actually get your selfie or ID?

Not in every case. Yoti says the website receives only an “over” or “under” result or your age. It doesn’t deliver any directly identifiable information.

Persona’s FAQ for Reddit users says Reddit gets a date of birth after an ID check and an estimated age after a selfie check.

Veriff can hand over much more. According to its privacy notice, the website may receive identity verification data, including copies of your ID document and photo. The developer documentation also reveals that businesses can download stored photos and videos to keep verification proof.

So, the same technology could mean that a website never sees your passport or that it can access and even download it. The website’s privacy notice may help you understand what information it receives and how it’s used.

Selfie verification vs. facial age estimation: An important difference

Identity verification confirms whether you are the person on the ID. Facial age estimation asks roughly how old a face looks. For that, it doesn’t have to check your identity.

Yoti explains that its estimation turns the image into numbers. A trained model maps them to an age. It also removes the selfie once the estimate is completed.

Persona works similarly. For selfie-only estimation, it analyzes a non-uniquely identifying facial geometry and deletes it after determining the result. Comparing a selfie with an ID is a separate step. It confirms that the document belongs to you. Calling both “facial recognition” blurs a real difference.

That distinction was tested in February 2026. Researchers found a publicly exposed Persona testing frontend with about 2,456 accessible files. The files reportedly showed Persona could run facial-recognition checks against watchlists, screen for “adverse media,” and perform up to 269 distinct verification checks beyond age estimation. On March 13, 2026, Persona said the exposed environment was isolated from production. It also said that no personal data was exposed. Discord, which had been trialing Persona for age verification, ended that trial after the disclosure.

Is your face converted into biometric data?

Sometimes. A selfie age check may involve processing biometric data, but that doesn’t necessarily mean a lasting face profile is created. It depends on the technology, the provider, and the applicable laws.

Persona extracts facial geometry from selfies and IDs. At the same time, it says it collects biometric data only with your express consent.
Veriff’s retention table lists biometric face embeddings among the data it keeps in active storage, for up to three years.
Realeyes, another age-estimation provider, processes face embeddings temporarily for age and liveness estimation. But if a website enables uniqueness or returning-user checks, Realeyes may retain an embedding as a template. This numerical representation of your facial features can be used to check whether the same face appears again.

Who actually has access to your information?

Your information typically goes to the verification provider, often through a form embedded in the website. Depending on how the service works, the provider may also use third-party infrastructure to process or store it. This means the website you’re visiting may never access your selfie.

Providers also work with cloud and infrastructure vendors. Persona lists AWS, Google Cloud, and MongoDB. Yoti uses AWS to store verification results. It may also temporarily share an ID and selfie with its India subsidiary for manual fallback checks if the website requests them.

Some verification methods involve additional third parties. Yoti uses Equifax for certain email-based checks, with Equifax acting as an independent data controller. Yoti also describes using pseudonymized data for fraud prevention and insights. The website’s privacy notice may identify its verification provider, while the provider’s own documentation may offer more details about third parties involved.

How long do age-verification companies keep your selfie and ID?

Yoti vs Persona vs Veriff data retention

Age-verification companies can keep your selfie and ID from a few seconds to several years. There’s no industry-wide retention standard. How long your data is kept depends on the provider’s default settings, the website’s configuration, and any applicable legal requirements.

In a March 2026 joint statement, the UK’s ICO and Ofcom reiterated that organizations should follow the principles of data minimization and storage limitation. The point is that personal data shouldn’t be kept longer than necessary. Even so, providers differ in how they implement these requirements.

According to Persona’s privacy policy, its default for age assurance is to automatically delete personal information once an outcome is determined. However, customers may request longer retention in certain cases. The examples below aren’t directly comparable because they cover different types of data and verification setups.

According to Persona’s FAQ for Reddit users, all personal information, including images, is automatically deleted within three days. Highrise’s biometric privacy notice, however, addresses biometric data specifically. Highrise says it doesn’t receive or store that data itself, and that Persona deletes it within 30 days unless a longer period is legally required.

Veriff’s default retention schedules can be adjusted by customers. It may also retain certain data for its own legally permitted purposes, independently of the customer’s retention settings. Veriff’s Enterprise default is 90 days in active storage and three years in archive. Age estimation follows the same default.

Yoti deletes most data once the check is complete. However, it may retain ID data for 28 days when the website requests manual review.

Provider	What you submit	What the website gets	Is selfie/ID kept?	Retention	Training use
Yoti	Selfie, ID, or other methods, depending on the website	Over/under result or age in years	No, except during manual review	ID data kept for 28 days for manual review; results kept 6 months for the website	Age-check data not reused for its own R&D
Persona	Selfie, ID, or other methods	Depends on website (Reddit: date of birth or estimated age)	No, by default	Set by the website (3 days at Reddit; 30 days at Highrise)	No AI or model training
Veriff	Selfie, ID, video	Results May include ID copies and photo	Yes, by default	Enterprise default: 90 days active and 3 years archive	May train models on real or anonymized data

Can your verification data be used to train AI?

Providers say different things, so the wording matters here.

Persona says it doesn’t use any personal information, including biometric data, for AI or model training.
Yoti says it doesn’t reuse age-check data for its own research. It trains its algorithms on images collected with consent and during app onboarding.
Veriff says its models are trained on real or anonymized data under a mandate from its customer and with a valid legal basis. It may also retain certain data for other purposes, such as service development.

What happens if that data is breached?

Data that’s been fully deleted is no longer available to be exposed in a future breach. But data that remains stored can be. In October 2025, Discord said that about 70,000 users may have had government ID photos exposed. Hackers breached a third-party customer service vendor, 5CA, that handled age-related appeals. The attackers claimed far more, but Discord disputed those numbers.

Two other cases show the same risk. In July 2025, the dating-safety app Tea confirmed a breach involving about 72,000 images after an unsecured storage bucket was discovered. These included approximately 13,000 selfies and photo IDs submitted for account verification.

In February 2026, Cybernews reported that researchers had found an unsecured MongoDB database linked to identity-verification provider IDMerit. It reportedly exposed around 1 billion sensitive records across 26 countries, including names, national ID numbers, dates of birth, and KYC verification logs. However, IDMerit disputed that its own systems had been compromised.

The Discord incident involved a customer support system, not the age check itself. ID copies may remain stored after verification for purposes such as handling appeals. The Tea and reported IDMerit cases further illustrate the risks of keeping sensitive information in storage. Not every uploaded ID will leak, but retaining sensitive data longer can increase the amount exposed if a breach occurs.

Can you delete your verification data?

If you want to remove your verification info, start with the website. Yoti and Persona say the website is responsible for handling requests about data processed on its behalf. Veriff forwards requests concerning data it processes for a website to that website, while handling requests related to its own activities directly.

For Persona-held data, such as a saved Persona Wallet, there’s a separate route. The Persona privacy portal handles requests directly when Persona, rather than the business, controls the data, according to Persona’s Help Center. But deletion doesn’t always mean every copy disappears. Some records may need to be retained for legal, security, or regulatory reasons, even after a deletion request is processed.

Your rights largely depend on where you live. You can ask what data is held about you, request its deletion, and find out how long it’s retained. If your verification data has already been deleted automatically, there may be little or nothing left to remove.

What to check before handing over your face or ID

Who handles the check? Look for the provider’s name and privacy notice.
Does the check require your ID? If the website offers different methods, consider a selfie-only option instead of uploading an identity document.
What does the website get? It could receive only the verification result or copies of your images too.
How long are the images kept? Check whether deletion is automatic.
What are other possible data uses? Pay attention to fraud prevention, data sharing, and model training.
How do you request deletion? Find out where to send the request and who handles it.

Conclusion: Proving your age doesn’t always mean revealing your identity

In the best-case scenario, the process is simple. A provider checks your age, the website receives a result, and your images are deleted shortly afterward.

In other cases, ID copies may remain in storage for years or be shared with third parties.

Both approaches can fall under the label of “age verification.” The differences go beyond technology: what data is collected, who can access it, and how long it’s kept all matter. If a provider doesn’t clearly explain its retention practices, don’t assume your data is deleted immediately. Check its privacy notice or ask the website before uploading anything.

FAQ

It depends on the provider and the website’s settings. Yoti says websites receive only the verification result or age information, while Veriff may allow websites to access copies of submitted IDs and photos.

Age verification can be secure, but no system is risk-free. The risks depend on how your data is collected, protected, shared, and stored. Deleting selfies and IDs shortly after verification can reduce the amount of sensitive information exposed in a future breach.

No. Facial age estimation predicts a person’s approximate age, while facial recognition is used to match or identify faces. Some providers may also store facial templates for features such as returning-user or uniqueness checks.

It depends on the provider and the verification setup. Some delete images shortly after the check, while others retain them for days or longer. Veriff’s published Enterprise default includes 90 days in active storage and three years in archive.

Yes. Facial age estimation isn’t exact, so a system may estimate your age as higher or lower than it really is. Some services use an age buffer and may require another verification method when the estimate is too close to the minimum age.