Upgrade requests a verified email address by default
Source references: 5The migration guide says InternetIdentityProvider enables attribute verification by default and requests verified_email. Unless explicitly disabled, sign-in prompts the user to share an email address, adding personal-data disclosure to what was previously plain sign-in.
The user’s verified email may be provided through the authentication flow and to an application backend that consumes the attribute, adding linkable identity information to account or business data.
The migration guide explicitly says the upgraded InternetIdentityProvider enables attribute verification by default and requests verified_email. Unless the app disables it, users will be prompted to share their email at sign-in. This supports a personal-data disclosure risk, but the evidence is documentation of intended defaults, not proof that any email was collected or transmitted. Users can ask who receives the email, why it is needed, how it is retained, or confirm that the app uses withAttributes={false} to opt out.
`InternetIdentityProvider` now enables attribute verification by default. Existing apps that do not need email attributes must opt out explicitly.Show 4 other places
### 3. `InternetIdentityProvider` attribute verification is now on by default`withAttributes` now defaults to `{}` (enabled, requesting `verified_email`). This is a non-breaking addition from Internet Identity — existing apps continue to work as before, and users are simply prompted to share their email during sign-in. No code change is required unless you want to opt out entirely:```tsx// opt out — plain sign-in, no attribute request<InternetIdentityProvider withAttributes={false}>```- Sessions from all variants are stored the same way: `isAuthenticated`, session restore on reload, and `clear()` behave identically regardless of the variant used.- When the backend uses `caffeineai-authorization`, Google, Microsoft, and SSO sign-ins carry verified name/email attributes (and the SSO domain) to the attribute callback automatically — see the `extension-authorization` skill.`withAttributes` now defaults to `{}` (enabled, requesting `verified_email`). This is a non-breaking addition from Internet Identity — existing apps continue to work as before, and users are simply prompted to share their email during sign-in. No code change is required unless you want to opt out entirely:```tsx// opt out — plain sign-in, no attribute request<InternetIdentityProvider withAttributes={false}>```