LinkedIn from Microsoft locked me out — they demand I give my passport and access to my webcam to Persona

LinkedIn locked me out of my own account. The only way back is through Persona — a third-party service that wants a photo of my passport, a scan of my face, and a recording of my movements (liveness detection: turn your head, follow the dot, so a still photo can't stand in for me). The stated reason: "unusual activity." The real reason, of course, is big tech spearheading a movement toward absolute control over people.

The honest part first: LinkedIn has been good to me. For years it was the room where my professional life happened — clients found, collaborators met, work that mattered. Credit where it's due.

So this is not written in anger. It's written in the particular disappointment you feel when something you trusted changes the terms without asking.

One day, I simply could not get in. Not a warning, not a nudge — locked out. My account, my connections, years of work, sealed behind a screen that implied the problem was me: "unusual activity." There was one way back, and it was this: prove you are who you say you are. Reasonable enough — until you see how.

LinkedIn does not check your identity itself. It hands you to a company called Persona. To reopen the account that was already mine, I was asked to photograph my passport, scan the chip inside it, and take a live scan of my face — and give all of it not to LinkedIn, but to a third party I had never heard of and never chose.

That is the "friend's app." Let me introduce it properly, because the introduction is the argument.

Meet the friend: Persona

Persona Identities, Inc. is an identity-verification company in San Francisco, founded in 2018 by two former Dropbox and Square engineers. It is not small and it is not a charity: in May 2025 it raised $200 million at a $2 billion valuation — some $418 million in funding all told — from the kind of venture funds that expect identity to become very lucrative. Its own stated ambition is to build "the verified identity layer for an agentic AI world." It is LinkedIn's verification partner across more than 40 countries.

Here is what the verification actually involves. Persona asks for a photo of your government ID — for many users, an NFC passport — then asks you to scan the passport's chip, then to take a selfie. From the photo on your ID and the photo of your face, it generates facial geometry: a biometric map of your features, which it compares one-to-one to confirm the living person matches the document.

And that is only the part you can see. By its own privacy disclosures, Persona may also collect your IP address, device and browser fingerprints, phone number, national ID number, nationality, sex, date of birth, email and geolocation — alongside behavioural signals most people would never imagine were being recorded: pose checks, "suspicious entity" detection, and even hesitation detection, which notes whether you paused during the process.

Stop on that one. To get back into your own account, a company you did not choose measures the geometry of your face and watches how nervously you move while you hand it over.

Where does it go, and for how long? In the LinkedIn flow, Persona says it deletes the facial-geometry measurements immediately after processing and keeps your selfie and ID for up to 30 days. But Persona's own general processor policy allows it to retain ID and selfie-scan data for as long as three years after your last interaction, unless instructed otherwise — so the real answer is "it depends on the contract," which is not a comforting answer about a scan of your face and a copy of your passport.

And the risk of pooling the most sensitive data that exists into a single fast-growing vendor is not hypothetical. In February 2026, security researchers reported that Persona had left part of its infrastructure — including code tied to a government dashboard — exposed, raising pointed questions about how carefully all of this is held. One bad day at one company is all it takes for a passport and a face-map to stop being yours. And unlike a password, a face cannot be reset.

And that's before LinkedIn itself

Set Persona aside, and the platform you were being pushed back into has its own appetite. LinkedIn is owned by Microsoft, which bought it in 2016 for $26.2 billion. As of November 2025, LinkedIn shares more of your data — profile, feed activity, ad engagement — with Microsoft and its affiliates to target you with advertising across Microsoft's properties, and may use your public profile and posts to train generative AI. That setting is on by default.

So the full shape of "just verify your identity" is this: surrender your passport and a biometric scan of your face to a $2-billion third party, in order to regain entry to an account owned by a trillion-dollar one that has already opted you in to feeding its advertising and its AI.

That is not a security check. A security check protects what is yours. This asks for the most permanent, unchangeable thing you own — your face, your identity documents — as the toll for returning what was already yours.

The better way to live together

None of this needs a villain. The engineers at Persona and at LinkedIn are, almost certainly, ordinary people doing their jobs well. The problem is not wicked people; it is an incentive that has quietly decided your identity is an asset to be collected, and that a locked door is an efficient way to collect it.

Incentives change when people decline them. So I decline — calmly, and on principle. There are real reasons to verify identity online, and done with genuine consent, minimal data and honest retention, it can even be a good thing. But consent extracted from a person locked out of their own account is not consent; it is a toll. And a scan of my face is not a password I can change when it leaks.

The good of LinkedIn — the connection, the opportunity, the human network — is real, and worth keeping. The fix is not to burn it down. The fix is to insist that identity be asked for the way anything important should be asked for: by invitation, with the least data necessary, held briefly, and never as ransom.

Thank you, LinkedIn. For the years, and the work. But I will not buy back my own front door with my face.