You Just Scanned Your Face to Use a Chat App. Where Did It Go?
Face scans, ID uploads and what actually happens to the data. Who sees it, how long it is kept, and what regulators have already found wanting.
There is plenty written about how to pass an age check when it wrongly locks you out. There is almost nothing about what you handed over in order to pass. This is that question, answered as precisely as the public record allows.
What actually happens when you scan
The platform is usually not the one looking at your face. It hands you off to a specialist verifier, which does the analysis and returns a verdict. In Character.AI's case that verifier is Persona.
The sequence runs in three stages, and most people stop at the first.
- Signals. An algorithm reads your account history and usage patterns. If it is confident you are an adult, you never see a prompt.
- Selfie. If that is borderline, you are sent to the verifier to photograph your face. Software estimates your age from the image. No document involved.
- Document. If the estimate cannot decide, you are asked for a government ID.
What travels back to the platform is deliberately thin. Character.AI states it does not store your ID files or selfies on its own servers, and receives a pass or fail result plus an encrypted age bracket. The biometric data sits with the verifier, not the chat app.
How long it is kept
This is the question worth asking of any platform, and the answer is almost never on the page where they ask you to scan.
Persona's retention for biometric scans submitted through the Character.AI flow has been reported at seven days. That is a short window by the standards of this industry, and it is the right shape: verify, return a verdict, delete.
Retention is where providers differ most, and where the risk actually lives. A verifier that holds a face scan for seven days is a small target. One that retains images indefinitely to improve its model is a permanent database of faces attached to the fact that each person was trying to access an adult platform. That second thing is the one to care about.
The three questions worth asking
| Question | Why it matters |
|---|---|
| Who performs the check? | A named third-party verifier is better than the platform doing it itself, because the platform never holds the image |
| How long is it kept? | Days is reasonable. Indefinitely is a standing risk. If the answer is not published, assume the worse one |
| What does the platform receive? | A pass or fail token is the minimum viable answer. Anything more is data they did not need |
None of these are unreasonable to ask, and a platform that cannot answer them has not thought about it properly.
It is failing, and not randomly
Facial age estimation is a statistical guess, and like all such guesses it is not equally wrong for everyone. Accuracy is worse on darker skin tones, in poor lighting, and on adults who happen to look young. The error does not land evenly across the user base.
The consequence is adults locked out of accounts they have used for years, with chats in read-only mode, no warning, and an appeal route that means scanning again or sending a passport. People who have done nothing wrong end up choosing between surrendering a government document and losing years of their own writing.
That is a real cost and it is almost never counted when these systems get described as a reasonable compromise.
Regulators are not satisfied either
It is tempting to assume a platform doing biometric checks is at least compliant. Not necessarily.
In July 2026 Italy's data protection authority fined Character.AI 180,000 euros over its age assurance and gave it 120 days to produce a stronger plan. The order also required a cooling-off mechanism so that locked-out minors could not immediately re-register, and private-by-default profiles for minors.
So the current state of the art is a system invasive enough to lock out legitimate adults and still judged inadequate at keeping minors out. Both things are true at once, which is the uncomfortable centre of this whole debate.
What you can reasonably do
- Prefer estimation over documents. A selfie that produces an age bracket is far less exposing than a passport scan, and most flows only escalate if the estimate fails.
- Read the verifier's policy, not the platform's. The platform's privacy page will tell you it does not store your face. The question is what the verifier does, and that is a different document.
- Improve your odds before scanning. Bright even light, facing a window, no backlight. Most failures are photographic rather than biometric.
- Keep your own copies. If a platform can lock you out of your account on an algorithm's say-so, having your characters saved elsewhere stops that being catastrophic.
Where RolePlaya stands
No face scans and no document uploads. The platform has been adults only since launch, with an age gate rather than biometric verification, and no under-18 tier that needs separating from an adult one.
That position reflects where the law currently sits rather than a promise about the future. Requirements are moving quickly and vary by country, and any platform telling you it will never verify anything is guessing. What will not change is the principle: the minimum data needed, held for the shortest time that works.
For the wider legal picture, including which laws drove this and what is still pending, we covered the legislation separately.
Common questions
Does Character AI see my face scan?
No. The check is performed by Persona, a third-party verifier. Character.AI states it does not store ID files or selfies on its own servers and receives only a pass or fail result with an encrypted age bracket.
How long is a face scan kept?
For biometric scans submitted through the Character.AI flow, the reported retention is seven days. Retention varies enormously between providers, and it is the single most important question to ask, because a short window is a small risk and an indefinite one is permanent.
Why did the age check say I was underage?
Facial age estimation is a statistical guess and it is less accurate on darker skin tones, in poor lighting, and on adults who look young. Being wrongly flagged is common and is not evidence of anything about your account.
Do I have to upload a passport?
Usually only as a fallback. Most flows start with account signals, escalate to a selfie estimate if that is inconclusive, and request a document only when the estimate cannot decide. Getting the selfie right first time avoids the document stage entirely.
Is biometric age verification legally required?
Not in that specific form. Laws generally require effective age assurance rather than a particular method, so a face scan is a platform choice. In July 2026 Italy fined Character.AI 180,000 euros and ordered improvements, so doing biometric checks does not by itself mean a platform is compliant.
Character.AI, Persona and all other names used on this page are trademarks of their respective owners. RolePlaya is not affiliated with, endorsed by, sponsored by or connected to any of them. Retention periods, verification flows and regulatory positions described here reflect publicly reported information as of October 2026 and change frequently. This is general information, not legal advice. Verify current terms with each provider.
