Persona Identities, Inc., a San Francisco‑based KYC/AML firm, launched a new identity‑verification tier slated for July 8, 2026. The move follows a Series C led by Founders Fund and a Series D that added another $200 million. The company, founded in 2018 by former Dropbox and Square engineers, will now tighten access to its biometric tools for corporate usage by developers.

GDPR classifies biometric data as special category information, demanding explicit, freely‑given consent. In March 2026, Spain’s AEPD fined competitor Yoti €950,000 for improper consent and treating authentication as full identification. Persona’s February 2026 leak revealed hundreds of background checks per user and three‑year data retention, sparking GDPR concerns over consent specificity and law‑enforcement sharing. Platforms that integrate Persona's verification must assess compliance risks and ensure users are fully informed about data handling to avoid penalties and protect privacy and scheduling audits regularly for that every integration meets regulatory standards and supports transparent data practices while maintaining user trust and system integrity and reducing potential legal exposure.

Discord, which had trialed Persona with UK users, dropped the service after the leak, citing privacy doubts. Developers eyeing Persona must weigh the firm’s robust verification against its regulatory exposure. Until the July rollout, companies can use existing Persona APIs, but any new deployment should undergo a GDPR audit to ensure compliance and mitigate risk.

The July 8 update will enforce identity checks for high‑risk features such as age verification on gaming and financial services. Persona claims its new policy will limit data retention to 90 days and introduce a consent‑logging mechanism. Industry observers note that tighter controls could reduce misuse but also increase friction for legitimate users seeking quick access.