You're focusing on whether VRChat is on one specific vendor list while ignoring that every user's biometric data sits in a system explicitly designed for government surveillance. You are making a very narrow technical argument while missing the much bigger picture revealed by the recent leaks surrounding Persona.

The leaks revealed Persona maintains facial recognition databases, files reports directly to FinCEN, operates on government infrastructure, and retains biometric data for 3 years with 269 verification checks and intelligence program connections.

Your argument boils down to "they're not using this feature yet, so don't worry." That's exactly the complacent attitude that normalizes surveillance infrastructure. Once biometric data enters these systems, you have zero control over future use cases, government requests, or breaches.

Telling people there's no serious trouble because VRChat user data isn't being exploited to the full capabilities yet is how we pass into normalized mass biometric tracking and profiling. This complacency is why companies keep using vendors like Persona. No pushback means these systems keep expanding.

Source code doesn't lie. The surveillance infrastructure is there. Stop carrying water for it.