Hacker News Reader

Comment by edwinwee | Hacker News Reader

We are very specific about collecting consent before doing anything with your data. We ask for permissions before beginning the verification process, and if you consent, we will only use your biometric identifiers for the verification itself. (And again, those identifiers—which contain the most sensitive info—aren't stored.) Specifically, we ask for an additional level of permissions before conducting any additional biometric analysis. https://support.stripe.com/questions/common-questions-about-...

View on HN

I think you might be missing the point. I'm sure gp does not doubt that you collect consent before collecting and using data. However, when presented with the choice of not giving up personal data and not using $awesome_service (or maybe even $essential_service), I’d imagine all but a very tiny percentage of people would reluctantly give up personal data. The data is then stored for three years, and if there's ever a leak, it would be hugely damaging given the scope:

> all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response.

> We are very specific about collecting consent before doing anything with your data.

How do you foresee that consent working if your product is used in account recovery flows?

For example, imagine if Steam adopted Stripe Identity as their only way to allow people with $$$$ worth of games to recover hacked accounts. If the user's only choice is to "consent" or lose their valuable account, that makes the "consent" something of a joke.

I'd be interested to hear how you plan to square that circle!

I have an account with a lot of content in it on an online service. When I signed up, they didn't require any personal information. Now they want some significant info or I can't get back into my account.

Reply on news.ycombinator.com