Soummaih Hydara's data-sharing decision reveals the real cost: longtime account holders can be flagged without warning, and the trade-off between bot prevention and privacy is far from settled.
Source material: privacysavvy.com
Ticketmaster has begun intercepting some customers mid-purchase with an extra identity checkpoint. When the company’s systems flag suspicious activity, the user must prove who they are before the ticket sale proceeds. According to Ticketmaster’s UK help page, the verification can demand a live selfie plus a photo ID such as a passport or driver’s licence. The software vendor behind the checks is Persona, which compares the selfie against the ID photo and runs checks to see if the document itself appears genuine. Ticketmaster’s stated goal is giving “real fans, not bots, a fair shot at getting tickets.” But for the customer suddenly facing a camera and a scan of their driving licence just to buy a concert seat, the first concrete question is simple: is the ticket worth the biometric data handover? The company frames the check as a protective layer, yet it introduces an immediate trade-off that fans now confront at the payment screen.
The live selfie requirement is more than a quick photo. Ticketmaster sends it to Persona, which performs facial comparison against the submitted ID, meaning the customer’s face becomes a biometric data point tied to a purchase. Tony Fitchue, a customer who spoke with WBAL-TV 11 News Investigates, said he would not want to place his government ID into a data system, and the same worry extends to the face scan. The risk is not hypothetical; cybersecurity expert Bill Sieglein told the outlet that bots account for roughly 60% of traffic on platforms like Ticketmaster and StubHub, which is exactly why the company pushed a biometric barrier. Yet the mechanism that keeps bots out also concentrates highly sensitive personal data in one vendor’s hands. A customer’s face and licence are not a password—a breach or internal misuse carries a different weight than a stolen credit card number.
The checks are not only hitting brand-new accounts. A July 2026 Reddit user reported that Ticketmaster flagged an account with more than ten years of activity for “bot or network activity.” The account holder was then required to provide a government ID and complete a live selfie check to regain the ability to buy tickets. The incident illustrates that loyalty and history on the platform do not exempt a user from the automated risk engine’s verdict. With no public count of how widespread these flags are, the anecdote leaves a practical worry: a legitimate fan who has bought tickets for a decade may suddenly face the same biometric gauntlet as a scalper. Ticketmaster’s automatic identity checks, outlined in a March 2026 account security update, apply based on its own risk scoring—leaving customers in the dark about why their long-standing account appears suspicious.
Soummaih Hydara put the consumer dilemma in plain terms when she spoke to WBAL-TV. She said she would likely complete the check if she genuinely wanted to attend the event, but she questioned whether the process was worth the personal information she would have to hand over. Her exact framing—asking herself if she really wanted to go to the game or concert—reveals the new psychological friction Ticketmaster has introduced. The company is betting that high-demand ticket access outweighs privacy hesitation. But Hydara’s hesitation suggests the check is not frictionless; it turns every flagged purchase into a deliberate decision about data cost. For customers who weigh their privacy budget, the choice is no longer just about ticket price or seating section. It is about whether a face scan and an ID upload are an acceptable toll for entry.
What actually happens to the biometric data after the check? Ticketmaster’s published help information draws a sharp line between outcomes. Successful verification data may be stored for no more than 60 days, but information from unsuccessful checks can remain for up to three years. Ticketmaster justifies the longer retention for fraud prevention—the logic being that failed attempts may indicate organised abuse. Cybersecurity expert Bill Sieglein warned that Ticketmaster and Persona must follow their own data rules, and that failing to do so could expose them to lawsuits. The retention asymmetry is a concrete detail that separates real policy from vague privacy promises: a bot operator’s failed selfie lingers for years, but a legitimate fan’s successful scan is deleted in two months. Customers who pass the check give up less long-term data, while those who fail may be tracked well beyond the incident.
The scale of the bot problem gives Ticketmaster's ID checks their justification. Automated systems can outpace regular fans, buying tickets before they get a fair chance, which is the exact harm the identity checks are designed to stop. The company's wider security toolkit, described in a March 2026 account security update, includes AI-based risk checks, passkeys, and multifactor authentication to spot suspicious activity before major ticket sales begin. The ID verification sits inside that broader effort, but the prevalence of automated traffic explains why a simple CAPTCHA is no longer enough. With automated systems able to bypass many normal security measures, a company that wants to sell tickets to humans has to find a way to tell the two apart—and identity checks are the bluntest instrument available.
The identity-check process balances convenience, ticket prices, and privacy. If stronger security helps a real fan beat an army of bots during a blockbuster sale, the inconvenience might be acceptable. But the process demands face images and government identification, which raises the question of how that data is stored and protected. The mechanism itself is explicit: Ticketmaster uses Persona to compare a live selfie with the photo on a submitted passport or driver’s licence, and Persona also checks whether the ID appears genuine. The scale of the bot problem is large—cybersecurity expert Bill Sieglein estimates that bots make up about 60% of traffic on platforms like Ticketmaster and StubHub, and they can circumvent many standard security measures. In practice, this means that during high-demand sales, a real customer may see an automatic identity check triggered by suspicious activity, even if their account is years old. That is why Ticketmaster has layered on additional tools—AI-based risk checks, passkeys, and multifactor authentication—alongside the ID verification. As a customer, the decision comes down to whether you accept the data retention terms: successful checks last up to 60 days, but unsuccessful ones can be stored for three years to fight fraud. Those are the conditions you agree to when you choose to verify yourself and continue toward a ticket.
Where this came from. This breakdown is based on source material published at privacysavvy.com. Images above are used with the credits shown beneath each one.
An internal review found 1,427 alerts, 1,000+ false positives, and a police supervisor who knew the plate mistake by heart – the reason points to a privacy tradeoff.
Mozilla's Ajit Varma on user control, concentration risk, and why the open web needs an independent engine.
Water utilities across seven states, rogue AI agents, and a wave of scams and legal battles — the week's security news in brief.