Toss Keeps Face Payment Photos for a Year After Users Leave, Naver Pay for 90 Days

Leaving face payment does not always delete the photo

Toss retains original face photographs for a year after customers leave its FacePay service if they have made even one transaction. Naver Pay keeps original photographs for 90 days after withdrawal from FaceSign. Both companies say the retention periods allow them to respond to payment complaints that may arrive after a customer stops using the service.

The Toss schedule is unusually precise: photographs belonging to users with a transaction history move into a separate database at 1 a.m. on the day after withdrawal and are destroyed at 10 a.m. on the 366th day. Users who registered but never made a transaction have their photographs destroyed immediately when they leave.

The distinction matters because withdrawing consent does trigger immediate deletion of another kind of face information: the numerical features used to identify a person. Both Toss and Naver Pay delete these biometric templates when a user withdraws from the service or revokes consent. An original photograph can therefore remain after the authentication template has gone.

South Korea's rules distinguish ordinary face photographs from information technically generated to identify a person. The controversy is not whether face payment operates entirely outside privacy law. It is whether current rules adequately govern the photographs left behind, how long companies should retain them, and how payment mistakes should be recorded.

A complaint challenging the Toss retention policy was submitted to the Financial Supervisory Service in September of the preceding year, according to information disclosed by Democratic Party lawmaker Park Sang hyuk. The account describing that complaint said it remained unresolved about a year later. No resolution date was given.

Why the companies keep the images

Toss says its retention period reflects the time customers typically take to submit payment complaints. Naver Pay also cites the possibility of later complaints about payment errors as its reason for retaining photographs for 90 days after a user leaves.

The difference between the two policies is substantial. A year is roughly four times Naver Pay's 90 days, although Toss specifies destruction on the 366th day rather than simply stating a number of months. The accounts do not establish that either period is a common industry standard or a deadline required by regulators.

Toss separates retained images from its active database after withdrawal. That is a storage safeguard, but it is not deletion. For a former customer, the central fact remains that the company still holds the photograph after the relationship with the face payment service has ended.

The complaint rationale also leaves a practical question unanswered: why must the original photograph remain for the chosen period, rather than other transaction records? No detailed assessment explaining the necessity of a year at Toss or 90 days at Naver Pay is described. There is also no payment specific statutory upper limit for retaining these photographs identified in the accounts.

A photograph and a biometric template have different legal treatment

A biometric template is a numerical representation of facial features that software uses to compare one face with another. It is different from an ordinary photograph, even though a photograph can be used to generate it.

Under the South Korean privacy framework described here, facial feature information technically generated to authenticate or identify a particular person is sensitive personal information. Separate consent and encryption requirements apply. An ordinary camera photograph is personal information, but it is not automatically placed in that same sensitive information category.

This distinction explains how the companies can immediately delete identification templates while retaining original photographs. It does not mean photographs have no privacy protection, nor does it establish that any retention period is automatically lawful. It means the two data types are treated differently, leaving the duration and justification for retaining the original image at the center of this dispute.

Park, the Democratic Party lawmaker raising the issue, warned that retaining photographs creates risks beyond the payment service itself:

If they are leaked while being stored, they could be misused for authentication on other services or for deepfake crimes.

That warning concerns what could happen after a leak. The accounts do not establish that either company's retained face photographs have been exposed or used in such crimes.

Rapid growth, with conflicting subscriber figures

Face payment links a registered face to a card or bank account. Once enrolled, a customer can pay by standing in front of a terminal camera, without presenting a wallet or smartphone. The process is described as taking less than a second.

Shinhan Card introduced South Korea's first face payment service in 2020. Adoption initially struggled to gain traction. Toss and Naver Pay subsequently expanded the market through FacePay and FaceSign, with Toss using registration coupons worth 5,000 won or 10,000 won and Naver Pay connecting its service to points and payment balances.

The subscriber figures differ between reports. One account gives Toss FacePay registration totals of 1 million at the end of the preceding year, 7 million in July and 8.4 million in August. A separate account dated October 7, 2026, says Toss formally launched FacePay in September 2025 and reported more than 7 million cumulative registrations in August 2026.

The October figure is a lower threshold, so it does not necessarily contradict 8.4 million. However, the accounts do not explain whether the totals use the same measurement or reporting date. The relative dates in the first account are not explicitly assigned a calendar year and should not silently be treated as identical to the October account's dates.

Within the first set of figures, registrations grew from 1 million to 8.4 million, an increase of 7.4 million and a total 8.4 times the earlier level. Toss's internal figures cited in the October account also say about 60% of people who had actually paid with FacePay used it again in June 2026. Registrations and repeat use measure different things, so neither figure establishes how many customers regularly use the service.

Withdrawals increased as the service expanded

FacePay consent withdrawals rose from 15,176 in April to 45,605 in May in the account detailing the retention dispute. That is an increase of 30,429, with May's total about three times April's.

Those numbers show more withdrawal requests, but they do not establish a withdrawal rate. A comparable count of active or consenting users for each month is not given. They also do not show how many withdrawals were motivated specifically by image retention, privacy concerns or payment problems.

The commercial expansion described in the October 2026 account could bring face payment into more everyday settings. Terminal supply was being pursued for about 5,000 small and medium sized supermarkets and 700 chicken franchise outlets. These are deployment plans, not a confirmed count of stores already processing transactions.

The scale makes the distinction between stopping payment authentication and deleting all related data increasingly relevant. Millions of registrations can coexist with immediate template deletion for departing users and continued photograph retention. A withdrawal does not necessarily have the same effect on every category of information held by the company.

Ten compensation cases do not establish ten recognition failures

Toss has reportedly paid compensation on 10 occasions in connection with FacePay payment error complaints. The cases included a situation in which a store employee pressed the FacePay button on a customer's behalf and a payment followed.

Toss says compensation did not mean every case involved a technical defect or an error for which the company was responsible. Its explanation was that, during the early stages of the business, it paid customers before determining whether their own actions contributed to the problem.

In the October 2026 account, Toss separately said it had received no damage claims involving one person's face being mistaken for another and a payment consequently being taken from the wrong account. That statement is narrower than saying there have been no payment complaints.

The distinction is essential. A system can identify a registered person correctly while selecting someone who did not intend to pay. Toss acknowledged that if only another registered user's face enters the camera view, that user's payment could be processed. Such a situation differs from software confusing two identities.

Claims circulated on social media that a bystander's account had been charged or that a photograph had been used to make a payment. These are allegations, not verified technical findings in the accounts. The 10 compensation cases, the company's denial of mistaken identity damage claims, and the described camera selection scenario should therefore not be collapsed into a single count of recognition failures.

Security claims address only part of the problem

Toss states that its facial authentication accuracy is 99.99%. Naver Pay states that its face identification accuracy exceeds 99%. These are company figures. Without shared testing conditions, definitions or independent evaluation results, they cannot support a direct ranking of the two services.

Both services describe several security stages, including face detection, image quality checks, checks for manipulated inputs, identity matching and unusual transaction detection. Liveness detection checks whether the camera is seeing a real person rather than a photograph or video. A fraud detection system examines transactions for suspicious patterns.

Toss also describes a model for distinguishing similar faces and secondary authentication in some cases, including identical twins. Naver Pay's customer guidance says a payment may fail if several faces enter the camera view at once.

These controls address different risks. Liveness checks target attempts to use an image instead of a person. Identity matching checks who the person is. Neither description alone establishes that the person selected by a camera intended to authorize the purchase.

The companies also describe encryption and conversion of facial information into numerical features. Toss says face related data is stored in an environment with network separation and that unencrypted original data is destroyed. That statement is not the same as saying every original photograph is deleted immediately: encrypted photographs can still be retained under the withdrawal policy.

Complaint records and compensation rules leave gaps

Financial Supervisory Service information submitted to Park's office recorded six complaints about face recognition payments over the preceding year. That figure cannot be directly compared with Toss's 10 compensation cases. One counts complaints received by a regulator; the other counts occasions on which a company paid compensation.

Face payment errors are also reported not to appear in the regulator's official accident reporting statistics because their classification does not make them subject to that reporting requirement. The absence of an incident from those statistics therefore does not establish that no complaint occurred.

The legal distinction concerns authorization. The account of the Electronic Financial Transactions Act says the relevant compensation category for fraudulent payment accidents centers on transactions carried out by an unauthorized third party. A payment mistake without such third party misuse is not automatically treated as that kind of accident.

Toss says it operates a policy of full compensation for losses from fraudulent transactions. Naver Pay provides a separate customer support process for users reporting a FaceSign payment they did not make. These arrangements should not be read as proof that every disputed payment has the same legal status or will receive the same response.

The unresolved issue is how to consistently classify a payment that identifies a person correctly but charges someone who did not intend to pay. The accounts give no finalized new reporting category, regulatory decision or scheduled hearing to settle that question.

Privacy oversight exists, but the retention standard is unsettled

The Personal Information Protection Commission conducted a prior adequacy review of Toss's face payment service in March 2024. The review addressed privacy handling for a process comparing a face verified during initial registration with a face captured at a payment terminal. This shows that the service underwent privacy scrutiny before the formal launch date described in the October 2026 account.

A separate intervention illustrates a different approach to retained images. In May of the year described in the retention report, the commission recommended that original photographs and face information used for mobile phone activation be destroyed immediately after comparison. That recommendation concerns phone activation, not a binding retention deadline for face payments.

The key dates and developments are:

• 2020: Shinhan Card introduced South Korea's first face payment service.
• March 2024: The Personal Information Protection Commission reviewed Toss's proposed face payment privacy arrangements.
• September 2025: Toss formally launched FacePay, according to the account dated October 7, 2026.
• June 2026: Toss's internal figures put repeat use at about 60% among people who had made a FacePay payment.
• August 2026: Toss reported more than 7 million cumulative registrations in the October account; another report gives an August figure of 8.4 million without explicitly identifying the year.

International comparisons also need care. Restrictions on police and public agency facial recognition in places such as San Francisco concern different uses from private retail payments. Europe's General Data Protection Regulation applies strict conditions to biometric processing for identification, but the accounts do not give a foreign photograph retention deadline directly comparable with the Toss and Naver Pay policies.

Park has called for explicit retention periods and management standards for face photographs, alongside closer tracking of payment complaints. No timetable for legislation, a revised company policy or a regulatory decision is identified. The immediate facts are that users can end authentication consent while an original photograph remains stored, and that payment disputes do not all enter the same official reporting system.

Key Points

• Toss retains original face photographs after withdrawal for users with any transaction history, destroying them at 10 a.m. on the 366th day.
• Toss immediately deletes photographs for users who never transacted. Naver Pay retains original photographs for 90 days after withdrawal.
• Both companies immediately delete biometric identification templates when users leave or revoke consent.
• Toss has reportedly compensated 10 payment complaint cases, but says these do not all represent technical failures.
• Six complaints were recorded by the Financial Supervisory Service over the period described. Face payment errors are not included in its official accident reporting statistics.
• Subscriber accounts give different August figures and date framing, so they do not establish one fully comparable total.
• No payment specific photograph retention ceiling or deadline for resolving the policy dispute is identified.