Loading story…
Discord has begun a global rollout of age assurance that classifies users as adults, teens, or unconfirmed and automatically applies age-appropriate access restrictions. The company says more than 90% of users should not need to actively verify their age; adults who are misclassified can use an eligibility-confirmation process to regain access to age-restricted content. The deployment builds on Discord’s earlier global teen-by-default safety settings.
The rollout replaces Discord’s February proposal to require facial age estimation or government-ID scans before users could enter age-restricted spaces. Discord revised the approach after substantial privacy backlash, sharpened by a 2025 compromise at a third-party verification provider that exposed government IDs for 70,000 Discord users in the UK and Australia. Organizations should note the reduced reliance on explicit identity checks but continue to assess how Discord’s age classification and appeal processes affect employee, community, and youth-safety use cases.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Discord began globally rolling out an age-estimation system that classifies users as adult, teen, or unconfirmed and restricts age-restricted content for teen-classified users. The company said rollout would take several days and that more than 90 percent of users should not need explicit age confirmation.
Hackers stole government IDs belonging to 70,000 Discord users from a third-party age-verification provider used by Discord in the UK and Australia.
Discord dropped its earlier proposal following user privacy objections, which were heightened by the prior theft of users' government IDs from an age-verification provider.
Discord's February age-check proposal would have required users seeking age-restricted content to submit government identification or complete a facial-age-estimation scan.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcediscord.com
Open sourcediscord.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Discord** announced a phased global rollout requiring users to verify their age using **video selfies or government IDs**, citing growing regulatory pressure for age checks on social platforms and a goal of providing a “teen-appropriate experience by default.” Discord said the verification data will be **deleted immediately after age is confirmed** and claimed it **will not leave the user’s device**; the company also described new defaults that restrict access to age-gated features (e.g., blurring sensitive content and limiting age-restricted channels/commands to verified adults). The rollout is expected to begin in early March, following earlier “teen-by-default” measures introduced in the U.K. and Australia. The policy change triggered backlash in gaming communities due to privacy and breach concerns, amplified by a prior incident in which **roughly 70,000 images of government IDs** were exposed after users had uploaded them for customer service purposes; reporting attributes the exposure to a **third-party service** Discord used to manage data. Discord is attempting to reassure users by pointing to tightened controls and a partnership with *k-ID* for age checks, but critics highlighted perceived ambiguity in how ID scans may be handled (including potential uploads to vendor servers and involvement of additional third parties), and warned that expanding collection of sensitive identity data increases the platform’s attractiveness as a target.
Jun 29, 2026
Google upgraded its *Results About You* safety feature to detect and request removal of additional sensitive identifiers exposed in Search results, including government ID numbers such as **passport numbers, driver’s license numbers, and Social Security numbers**. The update also streamlines Google’s process for reporting and removing **non-consensual explicit imagery (NCEI)**, including deepfakes and other AI-generated sexualized content, reflecting increased platform focus on limiting the discoverability of highly sensitive personal data and abusive imagery. Discord announced it will begin requiring **age verification** for access to adult content globally, using either an **ID upload** or an **AI-based video selfie** to estimate age. Discord stated that verification data will not be retained by Discord or its verification provider, claiming face scans will not be collected and ID images will be deleted after verification, highlighting ongoing industry movement toward stronger identity/age-gating controls alongside privacy assurances about data handling.
Jun 29, 2026
Security researchers investigating Discord’s UK age-verification rollout reported finding a **publicly exposed Persona frontend** (the identity-verification vendor used by Discord) on a **US government–authorized endpoint**, with **2,456 accessible files**. The exposed materials (since removed) allegedly revealed Persona’s broader **KYC/AML and surveillance-oriented capabilities** beyond age estimation, including **269 verification checks**, facial recognition comparisons against **watchlists** and **politically exposed persons (PEP)** lists, “adverse media” screening across multiple categories (including terrorism/espionage), and the generation of risk/similarity scores. The reporting also described extensive data collection/retention claims, including IP addresses, browser/device fingerprints, government ID numbers, phone numbers, names, faces, and “selfie” analytics, with retention described as up to **three years**. The discovery intensified backlash over Discord’s requirement that some users verify age (including via face scanning) to restore full functionality, and it fueled online allegations that the tooling could enable creation of broader watchlists. Persona publicly disputed insinuations of improper government ties and stated it invests in compliance and controls to protect sensitive data; it also said investors do not have access to Persona data and denied operational involvement by specific investors cited in the controversy. Ars Technica reported that OpenAI did not immediately respond to a request for comment regarding claims about an internal database related to Persona identity checks, while Persona characterized circulating claims as misleading and said any potential government engagements would be limited to workforce account security and exclude DHS/ICE.
Jun 29, 2026