Didit policy evolution
Before/after stance changes across captured policy versions, with exact citations. If no before/after delta is available yet, AIRIN shows the latest citation-backed stance events instead.
No before/after stance delta is available for this filter yet. Latest citation-backed stance events are shown below.
Jul 20, 2026privacyhigh
data sharing
Latest stance: sale or sell
“This section supplements this Privacy Policy for California residents and applies whenever Didit is a "business" under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). When Didit is a "service provider" or "contractor" to a Didit customer (a "business" under the CCPA), the customer's privacy notice governs the relevant verification flow and Didit processes personal information under the relevant Data Processing Agreement. Categories of personal information collected in the last 12 months (CCPA categories): Identifiers (name, email, phone, IP address, device identifiers). Customer records (billing, contact, account). Internet or network activity (browsing, interactions, telemetry). Geolocation data (inferred from IP). Sensory data (selfies, face images, liveness video, document images). Professional or employment data (for candidates). Sensitive personal information (SPI), including biometric information used to uniquely identify a consumer, government identifiers contained in identity documents, and account log-in credentials. Inferences drawn from any of the above (risk scores, fraud signals, decision outcomes). Purposes , the purposes listed in Section 4. Sale or sharing of personal information. Didit does not sell or share (as those terms are defined under the CCPA/CPRA) personal information, including biometric information. Use and disclosure of sensitive personal information.”
Open citationJul 20, 2026privacyhigh
data sharing
Latest stance: sale or sell
“Didit uses sensitive personal information only for the purposes permitted under California Civil Code § 1798.121(a) and the implementing regulations , to provide and secure the verification service, prevent fraud and security incidents, comply with legal obligations, and other purposes permitted without a separate consumer right to limit. Your California rights: right to know what personal information is collected, used, disclosed, and sold/shared; right to delete personal information; right to correct inaccurate personal information; right to opt out of sale or sharing (Didit does neither); right to limit use and disclosure of sensitive personal information (Didit's processing is already limited to purposes that do not trigger the right); right to data portability; and right to non-discrimination for exercising any of the above. Submit California requests to privacy@didit.me . Verification of your identity may be required before responding. Authorized agents may submit requests with proof of authorization. Global Privacy Control (GPC) and Do Not Track (DNT). Didit honors browser-based Global Privacy Control signals on the marketing site as an opt-out of sale or sharing, even though Didit does not sell or share personal information, GPC signals are recorded so that no advertising or analytics cookie that could be construed as sharing is set for that browser. Didit does not currently respond to legacy Do Not Track (DNT) headers because there is no industry consensus on how to interpret them; the GPC signal supersedes DNT for Didit's purposes.”
Open citationGenerated from live stance events. Informational only, not legal advice.