Claude wants to verify your identity: what it means for your business

What is Claude's identity verification?

In June 2026, Anthropic confirmed that it has begun asking some users of Claude, its AI assistant, to verify their identity before they can keep using certain parts of the service. In practice that means proving you are a real, specific person by uploading a government-issued photo ID and taking a live selfie, rather than just signing in with an email address. An updated section of Anthropic's privacy policy that formally covers this takes effect on 8 July 2026.

It is important to be precise about the scope, because early headlines made it sound universal. Anthropic says verification applies to a small subset of Claude's tens of millions of monthly users. You are not going to be asked to scan your passport every time you open Claude to draft an email. But the direction of travel matters for any business that is leaning on AI, so it is worth understanding exactly what is happening and why.

Why Anthropic is doing this now

Anthropic positions identity verification as part of its broader AI safety work. Better verification deters fraud and abuse, makes the models harder to attack at scale, and helps the company meet emerging rules that demand stronger accountability for who is using powerful AI. The thread running through all of it is the same: as AI becomes more capable, knowing there is a real, accountable person behind high-risk activity becomes more valuable.

Analysts at Forrester read the move as a milestone rather than a one-off. In their words, requiring verification for certain use cases shows that Anthropic believes generative AI and AI agents have become providers of high-risk, high-value transactions. That is the same logic that has long required identity checks in banking, payments and travel. Forrester also expects the major providers, including Google, Microsoft and OpenAI, to follow with verification of their own, which would make identity checks a normal feature of advanced AI rather than an outlier.

What you are asked for, and how it works

If you are one of the users prompted to verify, the process is short and follows a familiar pattern. Here is the path from prompt to result.

Who actually has to verify?

This is the question most business owners care about, so it is worth being concrete. Verification is not a blanket requirement. It is targeted at higher-risk activity and flagged accounts, and it can also be offered as an appeal, a way for a flagged user to stay on the platform instead of being cut off. The table below sketches who is more and less likely to see a prompt.

In short, if you run a single business account and use Claude for ordinary work within its usage policy, you are unlikely to be prompted. The teams most likely to encounter verification are those running automated or agent-driven AI workflows at volume, where platform integrity checks are most active.

The privacy questions worth asking

Handing a government ID and a selfie to an AI company understandably makes people pause, and it is healthy to ask hard questions before you comply with any verification request, from any vendor. Here is a fair reading of what Anthropic has committed to, and what remains open.

On the reassuring side, Anthropic says it chose Persona as its verification partner for the strength of its technology, privacy controls and security safeguards. Your ID and selfie are held by Persona, not Anthropic. Persona is told it may only use the data to provide and support verification and to improve fraud prevention. Everything passing to Persona is encrypted in transit and at rest, and Anthropic is explicit that it does not use identity data to train Claude or sell it on.

On the open side, the clearest unanswered question reporters raised is retention: Anthropic decides how long Persona keeps the documents, and it has not spelled out a firm deletion timeline. Some other companies that use Persona delete images almost immediately after processing, so it is reasonable to want the same clarity here. It is also worth knowing, for context, that Persona is backed by Founders Fund, an investor that also backs Anthropic, which is the kind of detail a privacy-conscious business may want to factor into its own risk view. None of this is a reason to panic, but it is a reason to read the terms and keep a record before you verify.

What it means for Australian businesses

For most Australian businesses, this changes very little in day to day terms, because ordinary usage is unlikely to trigger a prompt. The real value is in treating it as a prompt to get your AI governance in order, the same way you would for any tool that touches sensitive data.

The key local point is this: the data involved in verification, a government identifier combined with face geometry from a selfie, is sensitive information under the Privacy Act 1988, which the Office of the Australian Information Commissioner regulates. Sensitive information carries higher obligations than ordinary personal information. So if a staff member is ever asked to verify on a work account, that is a decision to make deliberately, not a box to click past. Think about whose identity is being shared, with which provider, and what your own privacy policy says about it.

The broader strategic read is that accountability is becoming part of how serious AI is used, alongside the security basics every business should already have in place. If you are building AI into customer-facing or revenue-critical work, treat identity and data handling with the same care you would give your cyber security and your AI visibility. Getting ahead of it now is far cheaper than scrambling later.

A simple readiness checklist

You do not need a heavy policy for this. A short, written approach that your team understands is enough. Work through these six points.

1. 1.Know who would be verified. Identify which staff or accounts run higher-risk or automated AI tasks, since those are the most likely to be prompted.
2. 2.Decide who approves it. Make verifying on a work account a deliberate decision signed off by a named person, not something any team member does on the spot.
3. 3.Read the terms before you verify. Check what is collected, who holds it, how it is used, and how long it is kept. Save a copy for your records.
4. 4.Keep client data out of at-risk accounts. Do not run unusual, high-volume or experimental activity from the same account that handles sensitive customer information.
5. 5.Note it in your privacy records. If staff identity data is shared with a verification provider, reflect that in your privacy documentation under the Privacy Act 1988.
6. 6.Expect it to spread. Assume other AI providers will add verification too, and write your approach once so it covers any vendor.

Handled this way, Claude's identity verification is not a threat to your business. It is an early sign of AI growing up, and a useful prompt to make sure the way you use it is as accountable as the rest of your operation.