# Mystery "personal data" fields in password policy

**URL:** <https://community.auth0.com/t/mystery-personal-data-fields-in-password-policy/66815>\
**Category:** Get Help\
**Created:** [July 26, 2021, 1:31pm UTC](https://community.auth0.com/t/mystery-personal-data-fields-in-password-policy/66815 "2021-07-26T13:31:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![markd](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/markd/32/38919_2.png) [@markd](https://community.auth0.com/u/markd)\
**Post date:** [July 26, 2021, 1:31pm UTC](https://community.auth0.com/t/mystery-personal-data-fields-in-password-policy/66815/1 "2021-07-26T13:31:39Z")

</div>

ref: [Password Options in Auth0 Database Connections](https://auth0.com/docs/connections/database/password-options#personal-data)

The “personal data” checks include checks against:

- `user_metadata.name`
- `user_metadata.first`
- `user_metadata.last`

Does anyone know what these are? I’ve not seen them before despite being on Auth0 for over 4 years. There are, or should be, no standard fields in `user_metadata`. I mean, I know what they are supposed to be, first name, last name, etc., but should these checks not reference the root `family_name`, `given_name`, …? Or is this just an error in the docs?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [July 26, 2021, 3:17pm UTC](https://community.auth0.com/t/mystery-personal-data-fields-in-password-policy/66815/3 "2021-07-26T15:17:23Z")

</div>

Hi @markd!

Let bring this question to our field team. I’ll report back here with the response.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [August 23, 2021, 4:32pm UTC](https://community.auth0.com/t/mystery-personal-data-fields-in-password-policy/66815/5 "2021-08-23T16:32:13Z")

</div>

Hi @markd,

I apologize for the delayed response. You are right in saying that we should expect no standard claims in the user\_metadata object. I can’t find a direct answer as to ‘why’ this exists, other than that it is an artifact from a historical implementation.

I’ve recorded this as product feedback.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [September 7, 2021, 4:32pm UTC](https://community.auth0.com/t/mystery-personal-data-fields-in-password-policy/66815/6 "2021-09-07T16:32:58Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.