Skip to content
CheapVPN
UK edition
Adult privacy

Who keeps your selfie or ID after an online age check?

An age check can create three records with different lifetimes. Follow a UK example from the camera image to the result the adult site can keep, then see how to ask about your own data.

“Your selfie is deleted” answers one question. It leaves another open. Can the website still remember that the person signed in to your account completed an age check on Tuesday? It can, depending on the system. A record of the outcome can survive long after the image used to produce it.

If you're deciding whether to verify your age for adult content, start by opening the privacy notice on the actual check. Jot down the name of the website, the company carrying out the check and the name of the product. A company that offers a reusable identity wallet may also operate a one-off checking service under different terms.

Follow the evidence, the result and the account

Record Example The question to ask
Original evidence A camera frame, document photo or details supplied by a bank Who sees it, and when is it erased after a pass, a failure or a manual review?
Check result An over-18 answer, an age estimate, a timestamp or a transaction reference What is returned to the site, and does the checker retain a copy?
Site or device record A verified flag on an account, or a credential in a browser What can be connected to that result later, and what happens if I delete it?

A threshold answer means the website may be able to admit an adult without receiving their date of birth. Someone who completes the check while signed in can still be identifiable to the website through their existing account. Consider which of those pieces of information you are comfortable with it holding.

A real example with three different retention periods

Yoti's Age Verification Services policy describes its one-off facial estimation service deleting the selfie when it produces the estimate. Its rules for checking an identity document are different when the client has enabled manual review. In that case the data can be held for 28 days. Yoti also says it stores the results of age checks for its client for six months unless the client deletes them sooner. The client may keep results longer in its own systems. Yoti's Age Verification Services privacy notice

Look at the distinction from the reader's end. Someone who completed a selfie estimate yesterday might be right to expect the image to have gone and still receive confirmation that a check record exists. Someone who uploaded ID for a service using manual review cannot work out the document's retention period by reading the selfie section. The figures above apply to that provider and product. Check the dates and wording on the service you actually used.

Four questions to ask before opening the camera

  1. Who is responsible? Find the organisation named as the controller and its privacy contact. A checker acting as a processor may direct your request to the site that hired it.
  2. Which fields leave the checker? An age in years reveals more than a yes-or-no answer. Look for what the operator receives together with the result, such as a reference it can associate with your visit.
  3. Does a failed attempt change retention? Find the sections on incomplete checks, manual review and fraud prevention. A statement about successful selfie estimates may cover none of these.
  4. What will the next visit require? A saved credential can spare you from repeating a check. Ask where it is stored, how long it works and how a person who shares your device could use it.

Ask about a check you have already completed

Use the privacy contact from the site's own notice. An account identifier, approximate time and check reference, if available, are a practical starting point. Avoid sending a fresh passport scan with an initial enquiry. The organisation can explain how to identify your record securely if it needs further information.

On [date] I completed [method] through your service. Please tell me what personal data you hold about that check, including images, results and references, who received it and the retention period for each item. I would like a copy of my personal data. Please erase anything you no longer need and explain any information you need to retain.

Clearing browser data can remove a local credential and prompt another check later. It does not send an erasure request to the company's systems. The UK right to erasure applies in particular circumstances, so ask the organisation to explain its reason if it refuses. If the reply leaves a concern unresolved, keep your request and reply together and follow the ICO's complaints guidance. ICO guide to erasure · How to raise a data protection complaint

If you are still choosing a method, the UK age-check comparison explains which options can work without a passport.

Keep reading

Related reading