Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document identifies two subprocessors, Persona (United States) and Yoti (United Kingdom), as handling fraud and abuse detection and identity verification specifically for Claude Free, Pro, and Max consumer accounts. These functions are not listed for Claude for Work, Claude Developer Platform, or Claude for Government.
This analysis describes what Anthropic's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Identity verification functions typically involve processing government-issued identity documents and may involve biometric data depending on the verification method, creating potential obligations under GDPR, UK GDPR, and state-level biometric privacy laws such as Illinois BIPA. The product-specific scope, limited to consumer-tier accounts, means enterprise and developer platform users are not subject to this processing under these listed subprocessors.
Interpretive note: The document does not specify the verification methods used by Persona or Yoti, making it unclear whether biometric data is processed, which would significantly affect regulatory obligations.
Under these provisions, identity verification for Claude Free, Pro, and Max consumer accounts is processed by two separate vendors: Persona in the United States and Yoti in the United Kingdom. Depending on the verification methods employed by these vendors, this processing may include document-based identity data or biometric information.
Cross-platform context
See how other platforms handle Identity Verification Subprocessors: Persona and Yoti and similar clauses.
Compare across platforms →Monitoring
Anthropic has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Persona • Fraud and abuse detection, identity verification United States Products: Claude Free/Pro/Max Yoti • Fraud and abuse detection, identity verification United Kingdom Products: Claude Free/Pro/MaxExcerpt from Anthropic's Sub-Processors
(1) REGULATORY LANDSCAPE: Identity verification processing engages GDPR Article 9 where biometric data is used, Illinois Biometric Information Privacy Act (BIPA) for Illinois residents, and sector-specific identity verification regulations. Yoti, operating in the United Kingdom, is subject to UK GDPR oversight by the Information Commissioner's Office (ICO). Persona, operating in the United States, is subject to FTC Act oversight for consumer data practices. Transfer of EU personal data to Persona in the United States requires a valid GDPR transfer mechanism. (2) GOVERNANCE EXPOSURE: High. Identity verification functions frequently involve government-issued document data and potentially biometric or facial recognition data. If either Persona or Yoti employs biometric processing, this triggers heightened regulatory requirements including explicit consent under GDPR Article 9 and BIPA-specific consent, retention, and deletion obligations. The document does not specify the verification methods used, creating uncertainty about the exact data categories processed. (3) JURISDICTION FLAGS: Illinois residents face potential BIPA exposure if biometric identifiers are collected. EU and EEA users are subject to GDPR Article 9 special category protections if biometric data is processed. UK users' data flows to Persona in the United States require UK GDPR-compliant transfer mechanisms. California residents may have CCPA rights regarding identity document data. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers whose employees use Claude Free, Pro, or Max accounts should assess whether identity verification data flows to Persona and Yoti are reflected in their data mapping records and DPAs. Procurement teams should confirm whether Anthropic's agreements with Persona and Yoti include appropriate data processing terms addressing biometric data handling, retention limits, and deletion obligations. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should clarify with Anthropic what specific verification methods Persona and Yoti employ, determine whether biometric data processing occurs and, if so, confirm that required consent mechanisms and retention schedules are in place, update Article 30 records of processing activities to reflect these subprocessors, and assess whether any state-level biometric privacy compliance obligations apply to their user populations.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Identity verification functions typically involve processing government-issued identity documents and may involve biometric data depending on the verification method, creating potential obligations under GDPR, UK GDPR, and state-level biometric privacy laws such as Illinois BIPA. The product-specific scope, limited to consumer-tier accounts, means enterprise and developer platform users are not subject to this processing under these listed subprocessors.
Under these provisions, identity verification for Claude Free, Pro, and Max consumer accounts is processed by two separate vendors: Persona in the United States and Yoti in the United Kingdom. Depending on the verification methods employed by these vendors, this processing may include document-based identity data or biometric information.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Anthropic.