What happens to my data during OnlyFans age verification?

Uploading an ID document and a selfie feels uncomfortable, particularly in this context. It is worth knowing what actually happens rather than relying on a vague sense of unease.

Who processes the data

The check is generally not carried out by the platform itself but by a specialist external provider. These companies run document checks and biometric comparisons for many platforms.

That means your data sits with at least two parties, the platform and the verification provider. Both are independently obliged to protect it.

What gets checked

Three things: whether the document is genuine, whether the date of birth puts you over eighteen, and whether the person in the selfie matches the person on the document. That last step calculates biometric features from your face.

Under the GDPR, biometric data belongs to a special category with heightened protection. Processing it requires an explicit legal basis, held to stricter requirements than ordinary data.

How long it is kept

This is where providers differ. Some delete the imagery after a successful check and keep only the result, meaning the confirmation that you are of age. Others retain it longer, because they have to demonstrate to regulators that a check took place.

Do not rely on assumptions. The specific retention period is set out in the privacy policies of the platform and the verification provider, and you are entitled to ask.

What rights you have

The GDPR gives you, among others:

• Access to what is stored about you
• Rectification of incorrect details
• Erasure, where no legal retention obligation applies
• Restriction of processing
• Complaint to a supervisory authority

These rights apply to companies outside the EU as well, where they target users inside the EU.

Where erasure stops

A deletion request does not automatically make everything disappear. Proof that an age check took place is usually subject to a retention obligation. What can often be deleted is the raw imagery, leaving only the result of the check.

That is what to ask for specifically, rather than demanding blanket erasure.

What you can do yourself

Upload only what is requested and nothing more. Use the platform's own interface and never a link from an email, because this exact situation is heavily exploited by fraudsters.

Do not black anything out on the document. It only causes rejection. Delete the images from your device afterwards, including from any cloud sync.

A common scam

Messages circulate claiming to come from the platform and asking you to verify again. They lead to convincing copies of the real site. A genuine platform does not message you asking to submit ID through an external link.

If in doubt: click nothing, navigate to the platform yourself, and check there.

How to make an access request

An access request under Article 15 GDPR requires no particular form. An email to the company's data protection address is enough, asking for all data held about you, the purpose of processing, the retention period and the recipients.

Write separately to the platform and to the verification provider, because each is independently responsible. The deadline is generally one month.

Keep the correspondence. If no answer arrives, or an incomplete one, it becomes the basis for a complaint to the relevant supervisory authority, and that is free of charge as well.

If you are unsure

We go through with creators which data sits where and which requests are worth making. If you have questions about it, get in touch. The conversation carries no obligation.