The document identifies two subprocessors, Persona (United States) and Yoti (United Kingdom), as handling fraud and abuse detection and identity verification specifically for Claude Free, Pro, and Max consumer accounts. These functions are not listed for Claude for Work, Claude Developer Platform, or Claude for Government.
This analysis describes what Anthropic's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Identity verification functions typically involve processing government-issued identity documents and may involve biometric data depending on the verification method, creating potential obligations under GDPR, UK GDPR, and state-level biometric privacy laws such as Illinois BIPA. The product-specific scope, limited to consumer-tier accounts, means enterprise and developer platform users are not subject to this processing under these listed subprocessors.
Interpretive note: The document does not specify the verification methods used by Persona or Yoti, making it unclear whether biometric data is processed, which would significantly affect regulatory obligations.
Under these provisions, identity verification for Claude Free, Pro, and Max consumer accounts is processed by two separate vendors: Persona in the United States and Yoti in the United Kingdom. Depending on the verification methods employed by these vendors, this processing may include document-based identity data or biometric information.
Cross-platform context
See how other platforms handle Identity Verification Subprocessors: Persona and Yoti and similar clauses.
Compare across platforms →"Persona • Fraud and abuse detection, identity verification United States Products: Claude Free/Pro/Max Yoti • Fraud and abuse detection, identity verification United Kingdom Products: Claude Free/Pro/MaxExcerpt from Anthropic's Sub-Processors
(1) REGULATORY LANDSCAPE: Identity verification processing engages GDPR Article 9 where biometric data is used, Illinois Biometric Information Privacy Act (BIPA) for Illinois residents, and sector-specific identity verification regulations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Identity verification functions typically involve processing government-issued identity documents and may involve biometric data depending on the verification method, creating potential obligations under GDPR, UK GDPR, and state-level biometric privacy laws such as Illinois BIPA. The product-specific scope, limited to consumer-tier accounts, means enterprise and developer platform users are not subject to this processing under these listed subprocessors.
Under these provisions, identity verification for Claude Free, Pro, and Max consumer accounts is processed by two separate vendors: Persona in the United States and Yoti in the United Kingdom. Depending on the verification methods employed by these vendors, this processing may include document-based identity data or biometric information.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Anthropic.