I verified my LinkedIn identity. Here's what I handed over

But I have such low faith in the platform that I would readily believe that once they think you're not going to continue adding value, they find unpleasant ways to extract the last bit of value that they reserve only for "ex"-users.

It amazing really. If you reached out to people and asked them for the information and graph that LinkedIn maintains, most employers would fire them.

It identifies users that visit your site and then shows their email, phone number and living place based on their Li profile ;))

I also saw... not sure what to call them, but honeypot friend requests? I used to get regular requests from profiles I didn't recognize with a generic pretty woman (I'd assume stock photography). Since I ignored them, they would re-request on intervals that were exactly 90 or 180 days. I occasionally glanced at them and there seemed to be no rhyme nor reason to their friends. I'd assume this was also some type of scraping, probably for friends-only profile data.

So maybe that's what happened?

Otherwise, LinkedIn can be quite useful in searching for a job, researching a company, or getting to know potential coworkers or hires.

Email spam is, to my mind, an inevitability. You should expect waves of spam, no matter what address you use; your email provider should offer reasonable filtering of the spam. Using a unique un-guessable email address, like any security through obscurity, can only get you so far.

Once a user verifies their identity with Persona, the software performs 269 distinct verification checks and scours the internet and government sources for potential matches, such as by matching your face to politically exposed persons (PEPs), and generating risk and similarity scores for each individual. IP addresses, browser fingerprints, device fingerprints, government ID numbers, phone numbers, names, faces, and even selfie backgrounds are analyzed and retained for up to three years.

There are so many keywords in there that should raise a red flag, but funded by Peter Thiel should probably be enough.

https://www.therage.co/persona-age-verification/

Even if the CEO believes it right now, what if the team responsible for the automatic-deletion merely did a soft-delete instead of a hard delete "just in case we want to use it for something else one day"?

If you let your legal team use such broad CYA language, it is usually because you are not sure what's going on and want CYA, or you actually want to keep the door open for broader use with those broader permissive legal terms. On the other hand, if you are sure that you will preserve user's privacy as you are stating in marketing materials, then you should put it in legal writing explicitly.

Which might not even be stated explicitly, it might be that they just move it somewhere and then pass it on again, at which point its outside the legal jurisdiction of your country's ability to enforce data protection measures.

Even if such a scheme is not legal, the fact that your data moves through multiple countries with different data protection measures, enforcing your rights seems basically impossible.

Certainly, you mean: "claiming that".

In the terms of Mandy Rice-Davies [1], "well he would, wouldn't he?" Especially, his claim that the data isn't used for training by companies that are publicly known to have illegally acquired data to train their models doesn't look very serious.

[1]: https://en.wikipedia.org/wiki/Well_he_would,_wouldn%27t_he%3...

Thus it is impossible to believe his words.

  > - All biometric personal data is deleted immediately after processing.

I'm not a security expert so please correct me. Or if I'm on the right track please add more nuance because I'd like to know more and I'm sure others are interested

- someone finally reading the T&Cs

- legal drafting the T&Cs as broadly as possible

- the actual systems running at the time matching what’s in the T&Cs when legal last checked in

Maybe this is a point to make to the Persona CEO. If he wants to avoid a public issue like this then maybe some engineering effort and investment in this direction would be in his best interest.

I thought everyone, at least in security would be somewhat concerned about this, but they're not. I get the benefits, and I want to enjoy those benefits too. I'd much prefer if I could privately confirm my name using IDs (zero problem with that) but then not have to show it or an exact profile photo. I'm sure there's a cryptographic way for my identity to be proven to any who I chose to prove it to who required such bona fides. I dislike the surface of "proven identity for everyone". You know?

This to me is the far more important thing than: "security focused biometric company processed my data, therefore being rational and modern I will now have a meltdown." Everytime you drive, use a payment method linked to your name, use your plan phone, your laptop, go to a venue that ID scans, make a rental, catch a flight, cross a border, etc, your ID (or telemetric equivalents sufficient to ID you) is processed by some digital entity. If you will revolt against the principle of "my government issued and not-truly-mine-anyway ID documents, or other provided bona fides are being read by digital entities contracted to do that", it seems nonsensical.

I think the bigger risk is always taking a photo of your passport and putting it on the internet, which is basically what the current LI verification means. Casual OSINT on a verified profile likely reveals the exact birthday (or cross-referenced on other platforms), via "happy birthday" type posts. How old am I type image AI can give you rough years.

Trust needs to earned. It hasn't been.

The big stick doesn't really exist.

Infrastructure: AWS and Google Cloud Platform

Database: MongoDB

ETL/ELT: Confluent and DBT

Data Warehouse and Reporting: Sigma Computing and Snowflake

that's the thing... excessively broad might not reflect reality TODAY but can be an opportunity in the future.

1) This is 'trust me bro' with more details

2) 'After processing' is wide enough to drive a truck through. What if processing takes a year? What if processing is defined as something involving recurring checks?

3) You have no contract with Persona or even LinkedIn beyond the fact that you agreed to LinkedIn's TOS (but didn't even read).

4) The company that acquires or takes-private Persona might have a very different of how it handles this.

5) What does verifying do for you, the user? I understand its value to LinkedIn and their ability to sell your attention to advertisers, but what do YOU gain?

I'm forced to verify to access my existing account.

I cannot delete it, nor opt out of 'being used for AI content' without first handing them over even more information I'm sure will be used for completely benign purposes.

I understand, and even agree, that how this is being handled has some pretty creepy aspects. But one thing missing from the comments I see here and elsewhere is: How else should verification be handled? We have a real problem with AI/bots online these days, trust will be at a premium. How can we try to assure it? I can think of one way: Everyone must pay to be a member (there will still be fraud, but it will cost!). How else can we verify with a better set of tradeoffs?

There is some info from Persona CEO on (of course) LinkedIn, in response to a post from security researcher Brian Krebs: https://www.linkedin.com/posts/bkrebs_if-you-are-thinking-ab... . I note he's not verified, but he does pay for the service.

They can do what they please. Its due to the network effects. The tie-ins of tech are so strong, I'd wager that %99 of why they succeed has nothing to do with competency or making a product for the user, just that people are too immobile to jump ship for too many reasons. Its staggering how much stronger this is than what people give credit for. Its as if you registered all your cells with a particular pain medication provider, and the idea of switching pills makes one go into acute neurosis.

At what point is that not enough for them to stop doing data brokerage or sharing?

This is why people sign up for LinkedIn.

They want to be targeted by companies for jobs. Or when they’re applying for a job, they want to be easily found by people at that company so they can see more information.

If you don’t want those things, you don’t need a LinkedIn page.

> Do the corporations that participate in this scheme provide mutual economic benefit? Do they contribute to the common wealth or are they parasitical?

You wrote a long hand wavey post but you stopped short of answering your own question.

The corporations who pay LinkedIn are doing so to recruit people for jobs. I’ve purchased LinkedIn premium for this purpose at different times.

After “targeting” those LinkedIn users, I eventually hired some of them for jobs. There’s your mutual economic benefit. This is why people use LinkedIn.

> It is a long causal change, so it is fair to ask whether there is any empirical evidence. If this is true we would expect to see ...? Well how about prices going up? Well how about in general people are less able to afford housing, food, cars, etc.

You think the root cause of inflation is… social media companies? This is an extraordinary claim that requires extraordinary evidence. You’re just observing two different things and convinced they’re correlated, while ignoring the obvious rebuttal that inflation existed and affordability changes happened before social media.

> Somehow the fundamentals of places like linkedin, gmail, google, facebook, etc have eluded people.

I think most people understand the fundamentals of LinkedIn better than you do, to be honest. It’s not a mystery why people sign up and maintain profiles.

LinkedIn is slightly different, as it's fundamentally framed as a job board and recruiting platform. The paying customers are recruiters, and the product is access to the prospective candidates. Hence, LinkedIn offering for free services such as employee verification, work history verificarion, employee vouching, etc.

b.) And more-or-less pretty much nobody ever that I remember suffered real consequences for doing what all the cool kids were doing.

c.) Thinking about all that logic stuff makes me unhappy and my head hurt so I won't do that.

Yes. In hell.

E.g. Job applications, rental references, clearance at existing jobs, citizenship and visa applications, digital signing for things like business contracts.

    Persona was not hacked. No database was breached.  Frontend code source maps were leaked, 
    which means unminified variable names were exposed revealing all the names of our features. 
    These names are already publicly listed in @Persona_IDV's help center and API documentation.

It’s used for keeping contacts, having your online resume in a standard place, and maybe messaging people.

The feed is a sideshow. It enrages a lot of people because it’s full of slop, but you need to treat it like almost everyone else: Ignore it. It’s a sideshow.

And of course those Europeans use LinkedIn for the network effect (even though LinkedIn is just a pathetic sad dead mall now, so most are doing so for an illusion), because other prior waves of Europeans also used LinkedIn, and so on. Domestic or regional alternatives falter because everyone demands they be on the "one" site.

The centralization of tech, largely to the US for a variety of reasons, has been an enormous, colossal mistake.

It's at this point I have to laud what China did. They simply banned foreign options in many spaces and healthy domestic options sprouted up overnight. Many countries need to start doing this, especially given that US tech is effectively an arm of a very hostile government that is waging intense diplomatic and trade warfare worldwide, especially against allies.

That's a hallmark of GPT spam, so it's not surprising there's hallucinations.

Good to know that work email verification doesn't involve Persona.

That seems like a reasonable middle ground. Work email is a much lighter ask than handing over government ID and biometrics.

Curious, does your verification status persist after you remove the work email (e.g., if you leave that employer)?

Of course, that works probably because my work has a linkedin account so they know what the official domain is for it.

I guess they'll spam that email but it's not like I care. I already receive spam offering me subcontracting services so I guess it's published somewhere.

No they don’t, not in the way that is implied here. A German court can subpoena German companies. Even for 100% subsidiaries in other European or non-European countries, one needs to request legal assistance. Which then is evaluated based on local jurisdiction of the subsidiary, not the parent. Microsoft Germany as operator is subject to US law and access. See Wikipedia “American exceptionalism” for further examples.

I can see not everybody here will agree with me, but I find this take absolutely reasonable. The European space has the capacity and the resources to create a product that replaces something as trivial as Linkedin, and yet it takes the lazy approach of just using American products.

It's the same thing with China's manufactured products, at some point the rest of the world just accepted that everything gets done in China and then keep complaining about how abusive China can be.

The most recent issue is the military question. Europe relied for decades on the "cheap" protection of the USA. Now the USA gave the middle finger to Europe and Europe acts shocked, but Europe is not so shocked when it comes to the military budget it did not spend on self defense during all the time the Americans provided protection.

Did you read the article? It's a dark pattern. It is an act that takes 3 minutes to perform. Yet it takes multiple days of reading legal documents to understand what actually happens. I would argue this feels wrong, to most people who interact with technology.

We have a set of laws here that companies are obliged to follow, regardless of where they are incorporated, so we expect that. We are used to having some basic human rights here, perhaps unlike most Americans these days.

Data processes and ownership of biometric data should be made explicitly clear. It shouldn't take days of reading to understand. It feels wrong to me too.

Claiming "the EU had 20 years to build an equally successful product" is the geopolitical equivalent of a deeply dysfunctional 1950s household. For decades, the husband insisted he handle all the enterprise and security so he could remain the undisputed head of the family. Then, after squandering his focus on a two-decade drunken military bender in the Middle East, he stumbles home, realizes he's overextended, and screams at his wife for not having her own Silicon Valley corner office, completely ignoring that he was the one who ruthlessly bought out her ventures and demanded her dependence in the first place.

America engineered a digitally dependent Europe because it funneled global data straight to US monopolies. To blame Europeans for playing the exact role the US forced them into is historical gaslighting. And pretending the CLOUD Act's global, extraterritorial overreach is the same as local EU law enforcement is just the icing on the delusion cake.

As a fairly vociferous eu person....I fully agree.

However, gdpr covers all eu residents, so if US companies don't want to obey eu law, that'sa fine, too.

So true.

There's a lot of passive-aggressive anti-US rhetoric and fearmongering on HN at the moment, while America is simply doing what it's always done - innovating and thriving.

As a European, I wish our continent was able to be more like America, as opposed to jealously coveting its outcomes.

Then you might hit a wall where nobody can do anything because you're trapped in the gears of some byzantine IT system that decides what can and can't happen at any given time with any given situation.

Then there's the labyrinth of the phone system itself littered low-bit smooth jazz and awful menus not often alleviated by AI voice recognition (which in my experience can sometimes be worse than the older voice systems) and the back and forth from one department to the next either because of the above or because someone or something keeps sending you to the wrong people to get your problems addressed.

If it's not engineered, it's some kinda emergent eldritch abomination that has slowly accreted over the decades.

Do you block remote image loading? They are probably measuring via tracking pixels.

It can be some more nefarious use, but it can also just be that they (persona in this case) use their services to process/store your data.

Because it should still be my choice as to what you do with it, which data you associate with it, and how you store it. Removing that choice is anti-privacy.

Why is that your assumption?

I'd consider that a feature that would increase trust in such a platform. These platforms require trust, right?

So that means you are participating in the evil that KYC services are.

So, in aggregate, all 17 data leeches are getting info. They are not getting info on all you users, but different subsets hit different subsets of the "subprocessors" you use.

And there's literally no way of knowing whether or not my data hits "two" or "three" or all 17 "at the most".

> but especially your _face_ is going to be _everywhere_ on the internet. Who are we kidding here? Why would _that_ be the problem?

If you don't see this as a problem, you are a part of the problem

It's a strange logic. "Evil thing X will happen anyway so it's acceptable for me to work in a company doing evil thing X". You should be ashamed of building searchable databases of faces

Obviously our faces are public, but there’s no easy way to tie it to all my PII unless I give it to them.

When people leave in things like staccato language and Blogspot era emphasis, I feel like I might as well copy the Persona privacy policy and prompt my own AI(s) on the topic and read that instead.

That's exactly what I was thinking when I read that line. And there's nothing necessarily wrong with using AI to help decipher large legal documents, just be honest about it.

For people with GDPR rights, this link helps make a DSAR (though interestingly the US and many other countries are also available from the country dropdown, maybe they follow these rules everywhere): https://withpersona.com/dsar

This of course brings up the problem of having to verify the ID of the person who's requesting their ID to be deleted from their DB. So I am probably going to stop here.

I also received a separate email stating that my data was already scheduled for deletion if I used Persona through LinkedIn.

LinkedIn does not support smaller companies; it appears to rely on some kind of whitelist or known-enterprise system. This option is simply not available for at least 90% of users.

Depends on the company, but in a competitive job market any extra signal can help.

There are a crazy number of fake LinkedIn profiles out there that are used for scamming companies or people.

(whether it actually does or the monkeys now got a steady source of fake/stolen IDs is another matter)

We are moving into the opposite direction. Drink a verification can.

However, they have a very generous free trial for sales/recruitment. You could probably activate it and get real support.

This does not conform to the requirements of american KYC/AML provisions that require KYC service to store and leak PII.

I was once part of the process of creating one. After two rounds, business decided too much money is wasted here and all the nonsense will stay. Better to have too much listed than too little.

This is where I disagree. You basically have to use LinkedIn to participate in today’s job market. These large platforms that are protected by network effects should be highly regulated so they cannot abuse your privacy and rights.

When the author says that Persona claims the "legitimate interest" basis for these data, they're saying that Persona is trying to achieve maximum flexibility for using the data (since "consent" generally requires specific agreement on a specific use for the data, and the burden of maintaining the consent records, where "legitimate interest" does not).

https://www.bulletproof.co.uk/blog/consent-vs-legitimate-int...

And FP is a much worse modality to have registered because, as opposed to Face image, fingerprint is not affected by age. So that will match you 99.999999% for ever. Faces change.

And indeed, fingerprints are only accessible using privileged access. Not even you, the passport holder, has access.

I too declined on privacy grounds.

I think my account was active for 10 minutes when it got blocked due to "suspicious activity" and locked. All I have to do now to activate is give them more of my information including my phone number.

I've had this same exact thing happen with Facebook and Instgram too. Facebook was probably no less than 5 years ago so this is not new. You can usually confirm your identity (which they do not know), using your phone number (which they do not have). Read that again. :) They ALL do this.

The kicker is you will not find any sympathy because they start with jurisdictions (3rd world) where they can get away with it and people will lecture you about how you must have done something because Facebook never asked for their phone number or blocked them.

I had Airbnb ask for my passport 10 years ago ffs and I did give it and they still didn't want to give me the place until the proprietor intervened and sorted it out. I had the same exact helpful comments about it online that I described above. "You must have done something", "You're full of shit, they don't ask for passport at all".

This attitude by my "fellow men" is what bothers me most about this whole thing.

And now it's global, the same people will probably go "what do you have to hide", "you show your passport at the border don't you?".

dropped linkedin after ten years due to an id request.

hurts but if EVERYONE SAID NO it would be better tomorrow.

AWS EU region is not doing much, and I suspect most companies run on US providers. EU needs independent platform for this to matter.

I’m so tired of all these covert ops run by these businesses. They aren’t going to stop until there is a heavy price to pay.

It's not. The developers' bubble we're in on the HN is invisibly tiny compared to the real life. And normies are not only perfectly happy uploading all their PII to Persona - they won't even understand what's wrong with that.

A few months back I was evaluating one of the GPT-5 models for a side project. Turns out streaming via the API requires org verification, and I decided to look elsewhere.

In hindsight, a good decision given what just came out about Persona.

As a blogging platform it seems like a mess of fake posturing. Recruiters use it, but that mostly means you get lots of spam. You can find a job without LinkedIn. I deleted my account about a decade ago and feel increasingly justified every time I read about the current state of affairs.

After deleting I got a job from HN "who's hiring", joined a friend's company, and now freelance.

Don't forget that if you fly to a country you are also bound by their laws. They can do anything to you as long as they can make it stick under their laws. It's one thing that people often don't realise when flying somewhere, you are basically giving a blanket submission to their laws!

For this reason I have a long blacklist of countries I won't visit because they have laws I do not accept.

0. https://www.inc.com/joe-procopio/you-cant-find-a-job-because...

The alternative is stay far away from digital slavery. Keep out of the slaughterhouse. Never approach it, and denounce it with every breath and fiber of your being.

Do you have a phone? It's a surveillance device. Its entire purpose from day one was to enslave you. Do not participate.

The question is, how much are you willing to give up in order to obtain freedom? What lengths will you go to? How badly do you really want it?

Sadly, LinkedIn has replaced email for initial contact after fairs or in-person client meetings. New real-world contacts look you up on LinkedIn and then use it to ask for things like your email address or mobile number. Because of this, I'm even verified :-(.

Even though I use LinkedIn basically the same way Internet Explorer was used in 2009 (purely as a Firefox or Chrome downloader but not for browsing). LinkedIn is my initial contact details exchange, but not the platform to communicate.

> Isn't that just all ai slop?

It is. I basically get zero useful input. Just biased, shallow rubbish. If there is valuable content it is usually cross-posted from authors who also run blogs I already follow.

Edit: Spelling, grammar, style

Previous article: https://thelocalstack.eu/posts/ai-chatbot-gdpr-data-request/

All from a single blog post:

> that’s not just text, that’s biometric data.

> This isn’t a chat log. It’s a structured psychological profile.

> Not raw conversations — processed insights about who I am, how I think, what I fear, and what motivates me.

> They’re not just storing what you said — they’re analyzing who you are.

> They’re not just answering questions — they’re building a map of what you’re curious about, what you’re planning, what you’re worried about.

> Not because I trusted it — but because it was convenient not to think about trust at all.

> A profile this detailed isn’t just a record. It’s a tool.

> The oracle isn’t neutral. The oracle is taking notes.

> Not because I’m paranoid — because it’s true.

> Do it. Not because you need to delete everything — but because you should know what “free” or even “paid” really costs.

While copying and pasting all of this I read this at the end:

> I need to be honest about something: I wrote this post with an AI. Not just edited by AI. Written with it.

Wouldn't fool anyone anyway

Once it's a human contact Ai slop doesn't impact you.