Social media users who are thinking of verifying their IDs on LinkedIn may want to hold off for just a bit.
LinkedIn’s third-party ID verification partner Persona has come under fire this week for reportedly sharing users’ personal info with its own data partners, as well as accessing expanded data on users who seek to verify their information via the platform.
According to a recent report on The Local Stack blog, a security researcher recently went through Persona’s terms of service and process notes and found that the platform collects a broad range of information based on uploaded ID confirmation documents.
According to the reporter, who used a passport photo to confirm ID on Persona in order to gain LinkedIn verification, Persona’s system then cross-checked multiple data points to gather a range of insights. That information included the reporter’s full name, facial geometry, NFC chip data (extracted from the passport ID), national ID number, email, phone number, IP address, geolocation and more.
Persona then, according to the report, cross-referenced that data against government databases, consumer credit agencies, utility companies, postal address databases and additional sources.
Which is a pretty comprehensive background check to confirm identification, although it’s the expanded use of this data that was the most important point of note.
According to the reporter, that information was then made available to a collection of 17 “subprocessors” of this information, essentially sharing personal info with a range of expanded third-party providers, who theoretically could be doing whatever they want with it.
Persona CEO Rick Song has refuted the claims via a post on LinkedIn, in which he explained that the company does not process user data for any purpose other than confirming identity.
Song specifically noted that no personal data is used for AI training, and any biometric data is deleted immediately after processing, with all other personal data deleted within 30 days.
Song also said the list of subprocessors noted in Persona’s documentation is misleading, as customers are able to select which products are used in the ID confirmation, which dictates subprocessor access.
As such, Song said Persona isn’t sharing user data with unapproved third parties.
But the damage may have already been done. According to The Rage, Discord has now ended its trial of Persona as an ID verification partner in response to the concern. Other Persona partners are now seeking more detailed answers as to how the company is sharing user data with expanded partners.
If Persona is unable to provide adequate answers, it could be a significant blow to its business. And with 100 million LinkedIn users verifying their profile info in the app thus far (note: LinkedIn works with several verification partners, so not all of these users were processed through Persona), that’s a significant vector for data exposure.
