Hacking group ShinyHunters has claimed to have accessed the accounts of 560 million Ticketmaster customers
Ticketmaster May Ask for a Photo ID and Selfie Before Buying Tickets — Here's Why That's Happening AFP

Some Ticketmaster customers have recently been asked to submit a live selfie and a photo of their government-issued ID before being allowed to purchase tickets, a security measure the company says is designed to weed out bots and ensure real fans get fair access to high-demand events, even as the requirement has drawn privacy concerns from some users.

NBC 5 Responds, the consumer investigative unit of NBC Chicago, has been examining the partnership behind the new verification process, which relies on a third-party identity verification company called Persona Identities Inc., operating under the brand name Persona. According to business license filings reviewed by the outlet, Persona has been operating since 2018, though it remains unclear exactly how long Ticketmaster has used the company's services before the practice began drawing wider public attention this year.

According to Ticketmaster, the verification requirement is intended to protect the integrity of ticket sales for popular events by confirming that the person attempting to make a purchase is a genuine individual rather than an automated bot program designed to snap up large quantities of tickets for resale. "When Ticketmaster prompts a security check, Persona quickly confirms the buyer is a real person," the company said. "Persona uses encrypted, secure technology to confirm your identity."

According to Ticketmaster's own help center documentation, customers who are prompted to complete the security check are asked to provide a live selfie along with a photo of a government-issued form of identification, which can include a driver's license, state ID or passport. Persona then compares the photo on the submitted ID against the live selfie to confirm that the identification document belongs to the person attempting to complete the purchase, while also checking whether the ID itself appears to be genuine or potentially fraudulent.

Ticketmaster has said the legal name listed on a customer's account profile must match the name on the submitted identification document in order for the verification to succeed, and the company has encouraged customers to review and update their profile details, including confirming their phone number and email address are current, before attempting the security check. The company has also addressed how the process applies to minors, stating that fans under the age of 18 who are prompted to complete a security check must have a parent or legal guardian complete the verification on their behalf.

Not every customer who encounters the security check will be asked to submit a full photo ID. According to Ticketmaster Fan Support's responses to customer inquiries posted on the social platform X, most fans who trigger the security check are only required to complete a quick selfie verification, while a smaller subset of users may additionally be asked to provide a photo ID. "In some cases, Ticketmaster may require a Security Check through Persona to help verify account ownership and keep accounts secure. Most fans only need to complete a quick selfie check, but some may be asked to provide a photo ID," the company said in one such response to a customer.

The verification requirement has periodically been tied to specific high-demand ticket sales. When singer Noah Kahan's presale drew scrutiny earlier this year after fans reported being asked to complete ID or selfie checks, Ticketmaster issued a statement explaining the extra protections were implemented in partnership with the artist specifically for that sale. "Working in partnership with the artist, extra protections will be in place when signing up for the Artist Presale. Some fans may be asked to complete a short security check with a quick selfie, or in rare cases be asked for your ID. Thanks for participating and helping us protect this presale for fans," the company said at the time, adding that accounts with incomplete profiles or suspicious activity were the ones most likely to be flagged for the additional check.

Ticketmaster's broader stated rationale for the practice centers on protecting what the company describes as "real fans" from being crowded out by bots and professional resellers during high-demand ticket sales. The company has said the security check helps give genuine fans "a fair shot at getting tickets," a framing intended to address longstanding public frustration over bot-driven ticket scalping that has plagued major concert and sporting event sales for years.

Despite that stated purpose, the identity verification process has generated notable pushback from some ticket buyers concerned about the amount of sensitive personal data being requested, including biometric facial data and copies of official government identification documents. According to Ticketmaster's disclosures, Persona retains biometric data collected during successful verification attempts for no more than 60 days. However, for verification attempts that are unsuccessful, the company said Persona may retain that biometric data for up to three years for fraud prevention purposes, a distinction that has fueled some of the privacy concerns raised by customers.

Ticketmaster has stated that Persona does not share collected personal data with third parties beyond what is necessary to complete identity verification and prevent fraud or abuse. Even so, some customers have expressed skepticism regarding those assurances, particularly in light of Ticketmaster's parent company, Live Nation Entertainment, having previously disclosed a significant data breach affecting customer information. Comments circulating on social media have reflected that unease, with some users questioning why a company that has previously experienced a data breach would now be requesting biometric facial scans and government identification as a routine part of the ticket-buying process.

Ticketmaster's customer support channels have continued to field individual inquiries from fans confused or frustrated by the security check requirement, generally responding with variations of the same explanation regarding account security and bot prevention. The company's help center materials note that the security check can be triggered when signing into an account, and that fans will typically receive an update on the status of their submitted verification relatively quickly after completing the process.

As ticket resale bots and automated purchasing scripts have grown more sophisticated in recent years, ticketing platforms including Ticketmaster have increasingly turned to third-party identity verification services as one tool among several aimed at curbing bulk automated purchases, alongside other longstanding anti-bot measures such as CAPTCHA verification systems and purchase limits per account. Whether the added identity verification step meaningfully reduces bot-driven purchases without unduly burdening legitimate fans, or whether it primarily shifts customer frustration toward new privacy concerns, remains an open question as the practice continues to expand across more ticket sales and as more customers encounter the requirement for the first time.