Consent & IVS obligations
How to meet express consent requirements before calling POST /v1/verify
You must collect an individual's express consent before verifying their identity through the official identity verification network. This applies to all IVS business users, including VeroID developer and dashboard customers.
Official IDMatch guidance
IDMatch publishes up-to-date guidance for users of identity verification services. Use these resources when designing consent flows and privacy notices for your end users:
- Guidance for users (IDMatch) : compliance reporting and consent obligations
- Identity Verification Services Privacy Statement : matters you must notify individuals about when obtaining express consent
Hosted verify sessions (biometrics)
If you use hosted verify sessions, set biometrics on the create request. The person opening the link cannot turn that check on or off. Use consent disclosure version 2.0-biometric when the session includes a photo and live selfie, which is available for passport, driver licence, ImmiCard, and ASIC/MSIC. Use 1.0 when it does not. The hosted page shows the biometric consent statement only for those sessions, and links to veroid.com.au/consent.
VeroID API fields
Every verification request must include consentAttestedAt (ISO 8601 datetime when the subject gave consent) and consentVersion (version of the privacy disclosure you showed them). See API Reference and your participation agreement with VeroID for contractual requirements.
End-user privacy page
Individuals whose identity you verify may refer to veroid.com.au/consent for general information about how verification requests are handled. Your business remains responsible for the consent notice and privacy information you provide at the point of collection.