What specific data fields does OnlyFans collect during KYC and age verification?
Executive summary
OnlyFans requires identity and age checks that are carried out by third‑party verification providers and involve submission of a live selfie (short .gif) and a photograph of a government‑issued identity document; the third‑party uses face‑matching to verify age and identity while OnlyFans may receive a record of the onboarding result and collects financial data for payouts and anti‑fraud purposes [1] [2] [3]. Public materials from OnlyFans and its vendor partners describe document images, identity fields and payment details as the core inputs, but they stop short of publishing a single, itemized checklist of every captured data field, leaving some specifics unconfirmed in public reporting [1] [2] [4].
1. What OnlyFans’ own materials say is collected for verification
OnlyFans’ privacy and transparency pages state that age and identity verification are conducted by third‑party providers and that the process “involves” the provider collecting a short .gif taken from a selfie plus a photo of a government identity document, with the provider using face recognition to match them in order to digitally verify age and identity [1]. OnlyFans also explicitly says it asks creators to provide Financial Data as part of verification and payout eligibility, and that in some jurisdictions it receives from providers “Third‑Party Onboarding Data” to maintain a record of the verification [1].
2. Which vendors and methods are publicly linked to OnlyFans — and what that implies
OnlyFans has publicly worked with identity vendors such as Ondato (and industry reporting mentions firms like Jumio and Veriff in the vendor ecosystem), and vendor case studies describe automated ID checks that inspect document validity and run face‑matching workflows — i.e., users display a valid identity document and submit a live selfie/video for liveness and match checks [2] [5] [6] [4]. Vendor materials emphasize compliance (GDPR, ISO certifications) and server protections, implying collection of document images, metadata on document validity, and verification results [2] [6].
3. The concrete data types that appear repeatedly across sources
Across OnlyFans’ own page and vendor descriptions, the repeatedly mentioned inputs are: a selfie/live liveness capture (short .gif or similar), an image of a government‑issued photo ID, and financial/payment information needed to receive payouts (banking or payment account details) — all used for KYC, fraud prevention and payment compliance [1] [2] [3]. Independent guides and commentary likewise list government ID details and linked banking identity as necessary for creators to be paid and to meet legal requirements [7] [3] [8].
4. Biometrics and face recognition — what is collected, and what OnlyFans says it does not hold
OnlyFans states that the third‑party provider uses Face Recognition Data to match the selfie to the ID image to verify age and identity, but that OnlyFans “do[es] not collect, receive, possess, or have access to any Face Recognition Data collected or processed by our third‑party providers” — although OnlyFans may receive onboarding outcome data where law permits [1]. Vendor descriptions confirm automated face‑matching and liveness checks are standard parts of modern KYC flows [6].
5. What OnlyFans retains and what remains opaque
OnlyFans affirms receipt of financial data and, where permitted, “Third‑Party Onboarding Data” from verifiers [1], and vendor case studies claim they store logs and results under compliance regimes [2]. However, there is no public, itemized OnlyFans list in the cited materials enumerating every specific field (for example: full name, date of birth, ID number, address, document type, issuing country, bank account number) that it receives or stores — several secondary guides infer those typical KYC fields, but OnlyFans’ published snippets stop short of that exhaustive catalog [1] [7] [8].
6. Motives, messaging and potential blind spots in the reporting
Vendor case studies (Ondato) and privacy pages emphasize security, compliance and business necessity — messages that also serve commercial and reputational interests for both OnlyFans and vendors, which can underplay risks and highlight certifications [2] [5]. Independent blog guides and VPN/privacy sites reiterate encryption and compliance claims but rely on vendor or platform statements rather than independent audits, leaving open questions about retention durations, cross‑border transfers, and whether specific identifiers (full ID numbers, addresses) are routinely forwarded to OnlyFans or only kept by vendors [4] [9].
7. Bottom line and what remains to verify
The verifiable core: OnlyFans’ KYC involves a selfie/live .gif, a photo of a government ID, face‑matching by a third‑party provider, and financial data for payouts and anti‑fraud checks; OnlyFans says it does not receive raw biometric face‑recognition data but may retain onboarding records where law allows [1] [2] [3]. What is not fully documented in the cited public materials is an itemized field‑by‑field disclosure (exact ID fields, retention timelines, precise bank data elements forwarded to OnlyFans), so confirmation of those specifics would require vendor/platform transparency reports or regulatory filings not present in the supplied sources [1] [2].