Forms, Privacy, and Verification

Recently, our marketing folks asked the technical & security team if we could start providing some content for our corporate blog. We tend to be a little shy and prefer staying behind the scenes, but they managed to nerd snipe us by asking “Do our competitors really need that much information?”

So, with that, we’re going to kick things off with a post about forms, verification systems, and privacy.

Let’s take an example form from an unnamed competitor that starts their student verification flow (you’ll have to trust me that this is real):

That’s a lot of required form fields, and in their defense there are some they really do need. If you’re not verifying a student through Single Sign-On (SSO), an email address makes sense. In our flows, email-based verification is always the fallback mechanism we use if SSO is not available. But there are other fields that don’t have any clear reason to be there, let alone be mandatory (looking at you date of birth).

Our competitor would argue (pedantically) this information is required to be able to verify someone in their system. My counter point would be that they haven’t actually designed a good system. Or, more generously, they haven’t designed one that actually cares about the privacy of individuals.

So why does that actually matter? For the individuals going through the process, any data point they provide to a company has a risk of being leaked (which is unfortunately not uncommon), where it can then be used for identity theft and fraud. The silver lining is that there are some data points, like an email address, which can at least be changed. Unfortunately, others, like your date of birth, are ones you’re stuck with.

What about businesses? If you’re working with a verification vendor who is not practicing data minimization and collecting more information on your customers than is strictly necessary, your primary risks are financial and reputational. Financial risk comes from regulations like GDPR where even if they’re only your “vendor”, you may ultimately be responsible for the data collected. The reputational risk comes from being associated with a vendor that was breached and had Personally Identifiable Information (PII) from your customers. Those customers are not likely going to care about the distinction that it was your vendor and not you.

How can you minimize these risks? By avoiding collecting that data in the first place.

Let me take an opportunity to walk you through our academic verification flow. After beginning the verification process from one of our customers, the first page an individual will see is this:

No forms. Just a Start button, which when clicked will take them here:

At this stage they can put in their school’s name or their email address, and if we support that school for SSO they’ll get redirected to it to complete the process (if we don’t, other flows kick off, which we’ll touch on a bit later). And that’s it. No date of birth. No name. Not even their email address is required.

I can hear our competitors shrieking for you to look and notice the word “Email” in the search field. Clearly, we must at least sometimes collect emails here. Nope.

If you were to take a look at the source code of this page, you’ll see we just use the email domain as a way to search through our SSO institution list. After a school is found and clicked, only the institution gets sent so that we can redirect the individual. The search they do is completely local to that page and not submitted to us.

Now to be fair, our competitors would probably be quick to point out our document submission page and say “Proxi.id has forms that collect this information too! They’re just as evil as we are!” (maybe they wouldn’t use the word “evil”). And they are right that for document submission we have to ask for personal information.

The important distinction is that this is our method of last resort and we permanently delete the data within seven days of the review. We’re doing it because at that point we don’t have another option to ensure eligibility requirements for our customers’ offers are met, and it’s the only way to ensure 100% coverage globally. In our primary flow, we aren’t asking for date of birth, email address, or name. An individual looks up their school and that’s it.