Anthropic’s new privacy policy collects biometric data from flagged Claude users

Anthropic has updated its privacy policy to allow the company to require some Claude users to upload government-issued identification and submit selfie photos or videos for identity verification. The updated policy, which takes effect on July 8, introduces a new category of personal data collection that includes facial geometry templates, a data type that may qualify as biometric information under state privacy laws.

The change was first reported by TechCrunch, which obtained details of the updated identity verification policy published on June 17. Anthropic spokesperson Thariq Shihipar told the outlet the requirement applies to a “small subset of users” whose accounts have been flagged for potential policy violations but not outright banned, giving them a path to appeal through identity verification rather than losing access entirely.

Accepted documents include passports, driver’s licences, state or provincial IDs, and national identity cards. Digital IDs, screenshots, and photocopies are not accepted. Users who submit verification materials will also be asked to provide a selfie photo or video, which the system uses to generate a facial geometry template for matching against the submitted document.

Anthropic is not handling the verification internally. The company uses Persona, a San Francisco-based identity-checking platform, to process the documents and biometric data. Persona is backed by Founders Fund, the venture firm led by Peter Thiel, who is also an investor in Anthropic through that same fund.

That connection has drawn scrutiny before. Discord selected Persona for its age verification system in February 2026, then reversed course after users objected to sharing government IDs with a firm tied to Thiel. A separate security incident revealed that Persona data had been found on a US government-authorised endpoint, with roughly 2,500 accessible files, though the scope and sensitivity of those files has not been fully detailed.

The facial geometry data Anthropic now collects is particularly sensitive from a legal standpoint. Illinois’s Biometric Information Privacy Act classifies facial geometry as biometric data and imposes penalties of $1,000 to $5,000 per violation for companies that collect it without proper consent. Facebook settled a BIPA class action for $650 million in 2021, and the law has since become the benchmark for biometric privacy litigation in the United States.

Shihipar said the identity verification policy is “unrelated to the Fable or Mythos rollout,” referring to the Trump administration’s order forcing Anthropic to disable its most powerful AI models earlier this month. But the timing is difficult to separate from the broader tensions between the company and Washington, which have included a Pentagon supply-chain risk designation, an export-control shutdown of Fable 5 and Mythos 5, and reports that Amazon CEO Andy Jassy raised security concerns about Anthropic’s models directly with the White House.

Anthropic has tens of millions of monthly users, and the company insists the verification requirement will affect only a small fraction of them. But for a company that has built its brand on safety and responsible AI deployment, asking users to hand over passport scans and facial biometrics to a Thiel-backed vendor introduces a trust question that technical reassurances alone may not resolve.

President Trump signalled last week that he no longer views Anthropic as a national security threat, following a G7 meeting with CEO Dario Amodei. Whether that diplomatic thaw extends to the regulatory pressures that may have motivated tighter user verification remains an open question.