Privacy isn’t disappearing because of surveillance alone — it’s disappearing because companies have discovered a new tactic: forcing users to hand over sensitive identification under the guise of “verification.” The justification is always framed as safety, fraud prevention, or “protecting children,” but the result is the same every time. Users lose privacy, companies gain data, and the process becomes normalized. What used to be an extreme request — uploading your government ID — has quietly become a routine part of online life.
Age verification is one of the most common excuses. Platforms claim they need your ID to keep minors safe, but the logic is backwards. To “protect” children, companies demand that children upload the very documents they should never be sharing. Instead of designing safer systems, they simply shift the burden onto users. The premise sounds noble, but the execution is invasive. A child trying to avoid online risks is now asked to upload the exact information predators and data thieves would love to have.
This pattern isn’t new. Blizzard tried it in 2010 with Real ID, a system that forced users to display their real‑life names on Blizzard’s forums. No aliases, no pseudonyms — your legal name, visible to millions. The backlash was immediate and overwhelming. Gamers pointed out that this would expose their identities to stalkers, harassers, employers, and strangers, effectively doxing the entire community overnight. Blizzard reversed the policy within days. Real ID didn’t require driver’s licenses, but it proved that even partial identity exposure can collapse under public pressure. It was one of the earliest examples of a company trying to force real‑world identity into digital spaces — and failing.
Facebook tried the same thing, repeatedly demanding government IDs from users to “prove their identity.” People were locked out of their accounts until they uploaded driver’s licenses, passports, or other documents. This happened to activists, whistleblowers, people escaping abusive situations, and anyone using a pseudonym for safety. Facebook framed it as anti‑fraud, but it functioned as mass identity harvesting. And once Facebook had your ID, you couldn’t take it back. Closing your account didn’t erase the data they already collected.
Financial platforms like PayPal have also contributed to the erosion of privacy. Their ID verification requirements were meant to prevent fraud, but they ended up exposing vulnerable people when PayPal mishandled user data. People living in hostile environments or using pseudonyms for safety were suddenly forced to reveal their legal identities. A system meant to protect users instead doxed them. And unlike banks, PayPal isn’t held to strict KYC retention laws — they can keep your documents indefinitely.
Now social media platforms are adopting even more invasive methods. Twitter’s bot‑detection system requires biometric verification — face scans — to prove you’re human. They promise to delete the biometric data after verification, but that promise is entirely discretionary. If their internal system flags you as “potentially malicious,” they can keep your biometrics indefinitely. And because the criteria for “malicious bot” are opaque, users have no way to know whether their data is actually deleted or quietly stored forever. A company asking for your face is asking for the most permanent identifier you have.
The most troubling part is that social media companies are acting as if they have KYC mandates like banks and crypto exchanges. But they don’t. There are no laws requiring Twitter, Facebook, Blizzard, or any other social platform to collect government IDs or biometrics. There are no regulations limiting how long they can store that data, how they must protect it, or what they can do with it. Users are handing over sensitive information to companies that have zero legal obligations to safeguard it. It’s voluntary only in the sense that you can choose to lose access to your account instead.
For beginners, the key idea is simple: privacy isn’t being taken — it’s being asked for. Companies don’t need to spy on you if they can convince you to upload your ID, your face, your documents, and your biometrics willingly. They frame it as safety, but it’s really about control. And because there are no laws protecting users from this kind of overreach, the trend will continue until people push back or build alternatives that don’t require verification at all.
