Anthropic Updates Privacy Policy: Claude May Ask Users to Verify Identity Documents

The Core Change: AI Chatbots Now Want to "See Your ID"

Anthropic recently quietly updated its privacy policy, with one notable change: under "certain circumstances," the Claude chatbot may ask users to verify their age and identity, using official documents such as passports or driver's licenses.

Anthropic privacy policy change coverage

This change marks a significant step for the AI industry in user identity verification, sparking widespread discussion about the balance between privacy protection and security compliance.

Why Are AI Companies Starting to Care About Identity Verification?

Regulatory Pressure Around Minor Protection

Regulatory pressure on AI products continues to intensify globally, with minor protection being one of the core issues. Multiple countries and regions have already enacted or are advancing legislation requiring tech companies to effectively verify user ages. The EU AI Act officially took effect in 2024, classifying AI systems by risk level and imposing strict transparency and user protection requirements on high-risk AI systems. While the United States has yet to introduce unified federal AI legislation, states like California and Colorado have advanced local AI regulatory bills, and the FTC has issued multiple warnings about child protection in AI products. The UK's Online Safety Act explicitly requires platforms to verify user ages, and China's Interim Measures for the Management of Generative AI Services similarly sets clear requirements for minor protection. Under this multi-jurisdictional regulatory pressure, Anthropic's move is likely aimed at addressing this global regulatory trend to ensure Claude operates within compliance frameworks.

Large Language Models (LLMs) are deep learning models based on the Transformer architecture, trained on massive text datasets, with the ability to understand and generate natural language. Claude, as Anthropic's flagship product, employs techniques such as RLHF (Reinforcement Learning from Human Feedback) and Constitutional AI to align model behavior. However, even with these safety mechanisms, LLMs can still generate inappropriate content involving violence, pornography, or fraud guidance under certain prompts. "Jailbreak" attack techniques are constantly evolving, making it impossible to rely solely on model-level content filtering. Through identity verification mechanisms, Anthropic can add a user-level line of defense beyond model safety, more precisely controlling the features and content accessible to users of different age groups.

Security and Abuse Prevention

Beyond age verification, identity verification also helps prevent the risk of AI tool misuse. When users attempt to use Claude for high-risk operations or access sensitive features, an additional identity verification layer can serve as an effective security barrier. This is analogous to the KYC (Know Your Customer) mechanism in the fintech sector.

KYC was originally established in the financial industry to prevent money laundering and terrorist financing, requiring financial institutions to verify customer identities before establishing business relationships. Modern KYC processes typically include document verification (OCR recognition of ID information), biometric matching (liveness detection + facial matching), and database cross-verification. Introducing similar mechanisms in the AI domain presents unique challenges: AI interaction frequency is far higher than financial account opening, and overly burdensome verification processes would severely damage user experience. Additionally, AI companies typically lack the mature data security infrastructure and compliance teams that financial institutions possess. Anthropic may use third-party identity verification providers (such as Jumio, Onfido, etc.) to handle document verification, reducing the risk of directly handling sensitive data themselves.

The Privacy vs. Security Dilemma

Core Privacy Concerns for Users

Requiring users to submit sensitive personal information like passports or driver's licenses to an AI company inevitably raises serious privacy concerns. These documents contain large amounts of sensitive personal data, and a data breach could have devastating consequences. In recent years, data breaches at tech companies have been frequent—in 2023, identity verification provider Okta was compromised, affecting all customer support system users; Australian telecom giant Optus leaked passport and driver's license information of nearly 10 million users. Unlike passwords, users cannot simply "reset" their passport numbers or facial features, making the consequences of identity theft more lasting and severe.

Users have legitimate reasons to raise the following questions:

How will identity document information be stored and processed? Will privacy-protecting technologies such as end-to-end encryption or zero-knowledge proofs be used?
How long will data be retained? Will original document images be immediately deleted after verification is complete?
Will data be shared with third parties? If third-party verification providers are used, how is security guaranteed across the data flow chain?
What responsibility will Anthropic bear in the event of a data breach?

Under regulations like GDPR, processing such highly sensitive data requires a Data Protection Impact Assessment (DPIA) and the adoption of technical and administrative measures such as encrypted storage, data minimization, and time-limited deletion. How Anthropic addresses these issues in its privacy policy will directly affect user trust.

Industry Precedents and Trends

Interestingly, Anthropic is not the first company to introduce identity verification mechanisms in AI products. As AI capabilities continue to grow, the entire industry is exploring how to find a balance between openness and security. OpenAI's GPT-4 API implemented tiered access for developers early on, opening different call quotas and model capabilities based on usage history and payment tier. Meta also set licensing thresholds for commercial use above certain scales when open-sourcing its Llama models.

In the AI safety research field, the concept of "Structured Access" was proposed by Oxford University researchers including Toby Shevlane, advocating for managing risks through API access controls, usage monitoring, and identity verification while maintaining open AI capabilities. Anthropic's identity verification mechanism can be seen as the concrete implementation of this academic concept in a commercial product. This trend may signal that future AI services will increasingly adopt tiered access models—basic features open to all users, while advanced or sensitive features require stricter identity verification.

Practical Impact on Users and the Industry

Changes to User Experience

For ordinary users, the experience of using Claude may change. Although Anthropic emphasizes that identity verification is only triggered under "certain circumstances," the specific trigger conditions remain unclear. This uncertainty itself may affect users' willingness to use the service, especially among privacy-sensitive user groups. Notably, user acceptance of identity verification varies significantly across regions—in markets where real-name registration is already widely implemented, users may more readily accept this requirement; in European and American markets with stronger privacy awareness, this could trigger greater pushback.

Driving Industry Standard Formation

From a broader perspective, Anthropic's move may drive the formation of AI industry identity verification standards. If major AI companies follow suit, we may see a more standardized AI usage environment. Currently, multiple standardization initiatives are advancing in the AI safety field, including NIST's AI Risk Management Framework (AI RMF) and the ISO/IEC 42001 AI Management System standard. Identity verification, as an important component of AI safety governance, may be incorporated into these frameworks in the future. This may benefit the industry's long-term healthy development, but will inevitably bring user friction and controversy in the short term.

Summary and Outlook

Anthropic's privacy policy update requiring identity verification reflects the AI industry's transition from a "wild growth" phase to a "standardized operations" phase. Between regulatory pressure, security needs, and user privacy, every AI company needs to find its own balance point. For users, paying attention to these policy changes and understanding their data rights is more important than ever.

Looking ahead, how AI identity verification mechanisms evolve, whether industry-unified standards will emerge, and how user privacy can be effectively protected will all be important topics worthy of continued attention. One noteworthy technical direction is the application of privacy-enhancing technologies such as Zero-Knowledge Proofs and Decentralized Identity (DID)—these technologies promise to verify age or identity attributes without exposing users' specific identity information, potentially offering a more elegant solution to the AI industry's identity verification challenge.