Claude can now ask you for your passport and a face scan. The vendor holding it already leaked IDs.

Starting July 8, Anthropic’s privacy policy lets Claude ask some Free, Pro and Max users to verify who they are before certain features keep working. Its support page — updated August 11 — spells out what that means: a government-issued photo ID (passport, driver’s license, national ID card; no photocopies, no screenshots, no digital IDs) and, in some cases, a live selfie. The policy applies to consumer accounts broadly, not one flagged edge case. The checking is outsourced to Persona, a third-party identity-verification company. Anthropic is careful here: “We are not using your identity data to train our models.” It doesn’t say how long Persona keeps the file.

Persona is not untested. In February, researchers found a chunk of its own front-end code sitting on a publicly reachable endpoint — one tied to a government-authorized integration — and the exposed source maps showed how the product actually works: facial-recognition matching, watchlist screening, checks for politically exposed persons, 269 distinct verification rules behind the form a user fills in. Persona’s CEO pushed back, calling this uncompressed front-end code “that’s already on every single person’s device,” not a vulnerability. Maybe so. Either way, Discord, which had just signed Persona for its own age-verification rollout, cut the partnership within a month and paused the rollout.

That wasn’t even Discord’s first identity-document scare this cycle. A year earlier, a different, compromised third-party support vendor exposed government ID photos that roughly 70,000 users had uploaded to appeal an age check, alongside their support tickets. Two vendors, two incidents, the same category of file both times: a government ID someone handed over so an app would keep trusting them.

None of this means Anthropic’s rollout goes the same way. It might not. But it’s the gap every version of this pitch leaves open: the safety of your passport and your face now depends on a company most users have never heard of, running checks nobody outside it can audit, under a policy that never states how long the copy is kept. “We won’t train on it” answers one failure mode. It says nothing about the other one — already live twice this year, in this exact category of data.

A file can’t leak from a vendor who was never handed it. A check built on something you already hold — a device, a passkey, a key nobody else has a copy of — never creates the file at all. That’s most of what “local-first” is actually buying: not a slogan, just fewer places a stranger’s copy of your passport can end up.

It’s the bet behind FOKL too — every tool you make stays on the device you made it on, and nothing you build asks you to prove who you are before you’re allowed to use it.

If an app asked for your passport tomorrow, would you even think to ask where the copy goes?