Persona Age-Verification Frontend Exposure Raises Privacy and Surveillance Concerns for Discord Users

Security researchers investigating Discord’s UK age-verification rollout reported finding a publicly exposed Persona frontend (the identity-verification vendor used by Discord) on a US government–authorized endpoint, with 2,456 accessible files. The exposed materials (since removed) allegedly revealed Persona’s broader KYC/AML and surveillance-oriented capabilities beyond age estimation, including 269 verification checks, facial recognition comparisons against watchlists and politically exposed persons (PEP) lists, “adverse media” screening across multiple categories (including terrorism/espionage), and the generation of risk/similarity scores. The reporting also described extensive data collection/retention claims, including IP addresses, browser/device fingerprints, government ID numbers, phone numbers, names, faces, and “selfie” analytics, with retention described as up to three years.

The discovery intensified backlash over Discord’s requirement that some users verify age (including via face scanning) to restore full functionality, and it fueled online allegations that the tooling could enable creation of broader watchlists. Persona publicly disputed insinuations of improper government ties and stated it invests in compliance and controls to protect sensitive data; it also said investors do not have access to Persona data and denied operational involvement by specific investors cited in the controversy. Ars Technica reported that OpenAI did not immediately respond to a request for comment regarding claims about an internal database related to Persona identity checks, while Persona characterized circulating claims as misleading and said any potential government engagements would be limited to workforce account security and exclude DHS/ICE.