Since creating this site, I’ve received dozens of messages from people telling me they have experienced similar issues on FetLife. Some had only a few dozen friends, while others had built up accounts with thousands of followers – then boom account locked.
A number of people have told me they were blocked or restricted shortly after uploading a profile picture. Others say they were then presented with a demand to submit a photograph of their identification. And that raises some very uncomfortable questions.
FetLife describes itself as a social network for the BDSM, fetish and kink community. For many people, discretion and privacy are not optional extras — they are absolutely essential. So why are some users apparently being asked to upload an uncensored photograph of something as sensitive as a passport or driving licence?
More importantly: what happens to that image after you press upload?
Who actually receives the ID? Can FetLife employees see it? Is a third-party company processing it? Is the original photograph stored anywhere? If so, where and for how long? Is it automatically deleted once somebody has been verified? Could it be accessed again later? What security measures protect it? And what happens if there is ever a data breach?
These are not insignificant details. A passport or driving licence can contain your full legal name, photograph, date of birth and other identifying information. If a website wants users to hand over that level of personal information, the process should be extremely transparent.
Yet from the verification prompts people have described to me, that transparency appears to be lacking.
There is also another question: why is uploading a full ID image necessary in the first place?
There are now numerous identity and age-verification services available to website operators. Many systems are specifically designed to confirm somebody’s age or identity while minimising how much personal information the website itself needs to handle. That makes it reasonable to ask why users may instead find themselves being asked to provide a photograph of an identification document.
I want to be very careful here. I am not claiming that FetLife is secretly building a database of passports. I am not claiming that submitted identification is definitely being retained. And I am not claiming that FetLife’s security has been compromised.
The problem is that users should not have to speculate about any of these things.
If you are asking somebody to upload one of the most sensitive documents they own, “we don’t know what happens next” is not a reassuring position to be in.
And history gives people every reason to ask questions. Huge companies with substantial security teams have suffered serious data breaches. Adobe has been breached. MySpace has been breached. Countless major websites and online services have discovered that being large, established or technically sophisticated does not make an organisation immune.
A kink social network arguably has even more reason to take privacy seriously. A breach involving an ordinary social network might expose an email address or password hash. A breach involving a kink platform could potentially reveal deeply private information about people’s identities, relationships, sexuality and interests.
Add identification documents into that equation and the consequences could become considerably more serious.
There is also the issue of people who do not have conventional photo ID at all. Not everybody drives. Not everybody has a passport. Some people have never travelled abroad and have never needed one.
Should those people effectively be excluded from a social network because they cannot provide a document they have never had any reason to obtain?
None of this means that identity verification itself is wrong. Platforms have legitimate reasons to combat fake accounts, underage users, fraud, impersonation and abuse. But verification and privacy are not mutually exclusive.
If FetLife is going to ask users to submit government-issued identification, then users deserve clear answers before they upload anything.
Who processes it? What information is extracted? What is retained? When is it deleted? Who can access it? What happens in the event of a breach?
Until those questions are answered clearly and prominently, I think anyone being asked to upload their passport or driving licence should stop for a moment and consider exactly what they are handing over.
Because once you upload your ID to somebody else’s server, you are placing an enormous amount of trust in whatever happens next.