Loading story…
The U.S. Federal Trade Commission (FTC) issued a policy statement clarifying it will not pursue COPPA enforcement against websites and online services that collect, use, or share personal data solely to perform age verification, addressing industry concerns that age-checking could itself trigger COPPA liability. The FTC said the exemption applies only when providers give clear notice to parents/children, limit use of the data to confirming age, avoid retaining the information after verification, and share it only with third parties they are confident will maintain confidentiality; the agency also emphasized the need to employ reasonable security safeguards and take reasonable steps to ensure age-verification methods and vendors provide reasonably accurate results.
The FTC said it plans to review the COPPA Rule to further address age verification, following earlier agency remarks framing age verification as an important child-protection tool. Separately, Discord announced it is postponing and modifying a planned global age-verification policy after user backlash, delaying rollout to the second half of 2026 and adding options beyond government ID or video selfies (e.g., credit card verification), along with commitments to vendor transparency and a forthcoming technical explanation of its “age determination systems”; this reflects broader regulatory pressure for platforms to verify user ages but is distinct from the FTC’s COPPA enforcement posture.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Alongside the policy statement, the FTC said it plans to review the COPPA Rule to further address age verification issues.
The FTC issued a policy statement saying it will not bring COPPA enforcement actions against websites and online services that collect, use, and share personal data solely for age verification if specified conditions are met. Those conditions include limiting use to verification, deleting the data afterward, providing clear notice, restricting third-party disclosures, using reasonable security safeguards, and taking reasonable steps to ensure accuracy.
Roughly a month before the policy statement, FTC officials described age verification as an important child-protection technology and indicated the agency would issue guidance to reassure companies about COPPA compliance.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Discord** announced a phased global rollout requiring users to verify their age using **video selfies or government IDs**, citing growing regulatory pressure for age checks on social platforms and a goal of providing a “teen-appropriate experience by default.” Discord said the verification data will be **deleted immediately after age is confirmed** and claimed it **will not leave the user’s device**; the company also described new defaults that restrict access to age-gated features (e.g., blurring sensitive content and limiting age-restricted channels/commands to verified adults). The rollout is expected to begin in early March, following earlier “teen-by-default” measures introduced in the U.K. and Australia. The policy change triggered backlash in gaming communities due to privacy and breach concerns, amplified by a prior incident in which **roughly 70,000 images of government IDs** were exposed after users had uploaded them for customer service purposes; reporting attributes the exposure to a **third-party service** Discord used to manage data. Discord is attempting to reassure users by pointing to tightened controls and a partnership with *k-ID* for age checks, but critics highlighted perceived ambiguity in how ID scans may be handled (including potential uploads to vendor servers and involvement of additional third parties), and warned that expanding collection of sensitive identity data increases the platform’s attractiveness as a target.
Jun 29, 2026
Discord has begun a global rollout of age assurance that classifies users as adults, teens, or unconfirmed and automatically applies age-appropriate access restrictions. The company says more than 90% of users should not need to actively verify their age; adults who are misclassified can use an eligibility-confirmation process to regain access to age-restricted content. The deployment builds on Discord’s earlier global **teen-by-default** safety settings. The rollout replaces Discord’s February proposal to require facial age estimation or government-ID scans before users could enter age-restricted spaces. Discord revised the approach after substantial privacy backlash, sharpened by a 2025 compromise at a third-party verification provider that exposed government IDs for 70,000 Discord users in the UK and Australia. Organizations should note the reduced reliance on explicit identity checks but continue to assess how Discord’s age classification and appeal processes affect employee, community, and youth-safety use cases.
Sep 25, 2026
Google upgraded its *Results About You* safety feature to detect and request removal of additional sensitive identifiers exposed in Search results, including government ID numbers such as **passport numbers, driver’s license numbers, and Social Security numbers**. The update also streamlines Google’s process for reporting and removing **non-consensual explicit imagery (NCEI)**, including deepfakes and other AI-generated sexualized content, reflecting increased platform focus on limiting the discoverability of highly sensitive personal data and abusive imagery. Discord announced it will begin requiring **age verification** for access to adult content globally, using either an **ID upload** or an **AI-based video selfie** to estimate age. Discord stated that verification data will not be retained by Discord or its verification provider, claiming face scans will not be collected and ID images will be deleted after verification, highlighting ongoing industry movement toward stronger identity/age-gating controls alongside privacy assurances about data handling.
Jun 29, 2026