A breach of user data from the social media company, Discord, is the most recent, high-profile example of nefarious actors exploiting the vulnerabilities of age verification mandates. Discord reported that 70,000 users were affected in the incident, and reports on a ransom request said that the attackers allegedly obtained data of over 2 million users, including data on IDs, passports, IP addresses, emails, limited billing information, and purchase history on the app.
Age verification is being rolled out all over the world. Although technology is improving to offer less invasive options, age verification is still part of a larger process that encourages the collection of sensitive information. The recent Discord data leak is an example of how private sector age verification techniques are evolving to comply with government mandates across the world—and why the larger debate around child online safety needs to evolve with it.
An increasing number of companies are adopting new technologies to more consistently age-verify users. In the United States, United Kingdom, and Australia, many companies are turning to age assurance, a method where users submit biometric information, such as a selfie, and software estimates whether users clear the age threshold.
Since its inception in 2015, Discord has restricted access to its services to users age 13 or older—but that restriction was easily circumvented. In the past, underage users could easily lie about their age and self-report as an “of age” user. As the globe has turned its focus to child online safety—with legislation and hefty penalties—social media companies have been refining their approach to more strictly enforce their rules. It was only earlier this year that Discord began using age assurance technology to verify users.
But age assurance technology is often inaccurate. In Discord’s case, mislabeled users can appeal age estimates through their customer service center by submitting a picture of their ID to prove their age and access the social media website. Unfortunately, it was this customer data that got leaked.
Lessons for policymakers abound. Many policymakers view face scans and other age estimation techniques as a substitute for hard age verification protocols that force users to fork over personal information, like drivers’ licenses, to businesses. But the reality of age verification is not “either-or.” Instead, as Discord’s data leak shows, it is often both.
This is because age assurance methods, which minimize the volume of data collected, are not perfect. Accuracy varies widely by sex, by race, by picture quality, and even by age itself. As a result, companies that use age estimation technology must still often resort to hard age verification techniques by checking government-issued IDs or passports when user ages are unclear.
This leaves policymakers in a tricky policy spot. As policymakers around the world augment age verification standards, rules, and laws to include new and evolving technologies, hard age verification techniques will (at a minimum) still be used to supplement other age verification technology, all with the same privacy problems consumers have dealt with for years.
This means data breaches of sensitive personal information will continue, and the Discord information leak is just the latest example. Uber, X, TikTok, and the dating app “Tea” have each had their own leaks of sensitive information related to age verification.
The recent Discord data breach has exposed more than just sensitive private user information to the world: it has also laid bare the limits of what age verification technology can do in a messy world.
Logan Kolas is the Director of Technology Policy and Pablo Garcia Quint is a technology policy analyst with the American Consumer Institute, a nonprofit education and research organization. For more information about the Institute, follow us on X @ConsumerPal.