The Tea App Data Breach: What It Tells Us About Identity Verification

Tea requires users to submit a selfie and a government-issued ID during signup. The app uses these to confirm the person is real and matches their identity document before granting access to the platform.

Yes — Tea’s verification process originally required users to submit a government-issued ID alongside a selfie. The app has since updated its process, but early users were required to provide identity documents as part of account creation.

The Tea app data breach exposed approximately 72,000 images from a legacy unsecured cloud storage bucket. This included around 13,000 verification selfies and government ID photos, plus approximately 59,000 images from user posts and messages.

Tea’s privacy policy stated that verification images would be deleted immediately after use. However, the breach revealed that images from users who joined before February 2024 were retained in an unsecured legacy storage system — meaning the deletion policy was not enforced in practice.

No — Tea is designed so that contributors remain anonymous. Verification selfies and IDs are not visible to other users on the platform. However, the data breach meant that verification images were exposed externally via an unsecured storage bucket, not through the app itself.

Tea’s verification process is typically fast — users submit a selfie and ID during account creation, and the review is usually completed within minutes. The app uses automated identity verification to approve accounts quickly.