Age checks and the ID breach

In plain terms

For most of its history Discord asked for a date of birth and took your word for it. Laws in the United Kingdom and Australia, and lawsuits in the United States, now require more. Discord's answer is to treat every account as a teenager's unless it has reason to think the owner is an adult.

Proving you are an adult means handing over something: a picture of your face, a picture of an identity document, or a pattern of behaviour for a computer to judge. Each carries a risk, and one of those risks has already come true.

Key facts

• Discord began age checks in the United Kingdom in July 2025, when the Online Safety Act's rules took effect.
• In October 2025 Discord said the identity documents of about 70,000 users had been exposed in a breach of a customer-support contractor.
• In February 2026 Discord announced "teen-by-default" settings for every account worldwide. Two weeks later, after a backlash, it delayed them to the second half of 2026.
• Discord says about 90% of users will never be asked to prove their age, because its own systems can infer it.
• In July 2026 a Texas court order gave Discord 90 days to apply UK-style checks to users in Texas.

How solid is this?

The labels are explained on the Start here page.

Why Discord is checking ages

Three pressures arrived together.

• Law. The UK's Online Safety Act requires services to keep children away from pornography and other harmful material, using checks that actually work. Enforcement began on 25 July 2025.² Australia required checks from December 2025.⁴
• Lawsuits. The US state complaints described in Part 1 allege that Discord did not enforce its own age limit.
• The product itself. Protections designed for teenagers only work if the service knows who the teenagers are.

How the checks work

Discord uses three methods.⁵

1. Inference. A system running in the background estimates whether an account belongs to an adult from signals such as how old the account is, whether a payment method is on file and what kinds of server it is in.⁶ Most users never see it.
2. Facial age estimation. The user records a short video selfie and software estimates their age. Discord and its vendor, k-ID, say the video never leaves the user's device.¹
3. An identity document. The user photographs a passport or driving licence. Discord says the image is deleted once the age group is confirmed.¹

None of these is proof. Inference can be wrong in both directions. Within days of the UK launch, users claimed to have passed the face check by pointing the camera at a character in a video game's photo mode.² An identity document shows that somebody owns a document, not that the person holding the phone is its owner.

The breach

On 3 October 2025 Discord disclosed that someone had broken into the systems of an outside company that handled its customer support. A few days later it put a number on the worst part: about 70,000 users had had photographs of their government identity documents exposed.³

The people affected were those who had contacted support to appeal an age decision and had sent a picture of their passport or driving licence to prove it. Names, email addresses and other contact details were also taken. Discord said its own systems were not breached and that messages and activity on the platform were not exposed.³

The attackers claimed far more. People saying they were responsible posted samples on Telegram, including more than a hundred identity photos, and according to Wikipedia claimed to hold about 1.5 terabytes of data and more than two million images.³⁴ NBC News could not verify the data, and Discord's figure of 70,000 has not been independently checked either.

A campaigner at the Electronic Frontier Foundation told NBC: "Age verification systems are surveillance systems."³ Discord stressed that the contractor was breached and Discord itself was not. That distinction is real, but it does not help the 70,000: they had been told to send their documents, and the documents were kept.

Teen-by-default, announced and delayed

In February 2026 Discord announced that from early March every account in the world would get the settings it gives teenagers, unless the owner was confirmed as an adult.⁵ Under those settings:

• messages from people who are not friends go to a separate requests inbox;
• friend requests from strangers come with a warning;
• sensitive images stay blurred;
• age-restricted servers and channels are closed;
• only verified adults can speak on stage in large audio events.⁵

Coming four months after the breach, the announcement was received badly. Users objected to face scans and identity uploads, and to one of the vendors Discord had tested, Persona, over its investors and its work for governments.⁶

On 24 February Discord's co-founder and chief technology officer, Stanislav Vishnevskiy, announced a delay to the second half of 2026. "We knew this rollout was going to be controversial," he wrote, and "we failed at our most basic job: clearly explaining what we're doing and why." He said about 90% of users would never be asked to verify, that the Persona test in the UK had ended, that a credit card would be offered as another way to confirm age, and that Discord would use only vendors that carry out the check on the user's own device. Discord no longer works with the contractor that was breached.⁶

Texas makes it an order

In July 2026, as part of the lawsuit described in Part 1, Discord agreed to a temporary injunction in Texas. Within 90 days it must give users in Texas the age checks and default protections it already applies in the UK, and report its progress to the state every 30 days. The order says Discord need not collect new kinds of personal information to work out who is in Texas, and may ask for more time. Discord admitted no wrongdoing.⁷

The effect is that a British law now sets the standard for an American state, by way of a court order rather than legislation. Other states that are suing have an obvious model to ask for.

The trade-off

There are three ways for a service to know someone's age, and each has a cost.

Child-safety campaigners and privacy campaigners are both right about their half. Without knowing ages, protections for children are optional for anyone willing to type a false birthday. With verification, a chat app becomes a place where identity documents are collected, and October 2025 showed what that can lead to.

Checking on the device, so that the image never travels, is a real improvement if it is true and stays true. It rests on the company's word and its vendors' engineering, and it does nothing for appeals handled by people.

What to do

• Only ever verify inside the Discord app, through its own settings. Nobody who messages you asking for a face scan, an ID or a code is doing an age check. This is already a scam: see Part 3.
• If you are asked to verify, know the options. Where a check can be done on your device, it exposes less than sending a document to a support team.
• If you sent ID to Discord support before October 2025, check whether you received a breach notice, and watch for misuse of that document.
• For parents: age checks do not replace the settings and conversations in Part 1. A child using an older sibling's or a parent's verified account has adult settings.

For professionals

• Do not assume an account's age band is right. Inference and estimation both make mistakes, and accounts are shared.
• For data protection officers. The 2025 breach came through a support contractor handling appeals, not the automated check. Exceptions handled by people are where sensitive data accumulates.
• For regulators. The Texas order shows that a protection built for one jurisdiction can be extended to another quickly once a company has it.
• For schools. Pupils will be asked to verify and will be offered ways round it. Both are worth a lesson.

What is still unknown

• Whether the worldwide rollout has begun. It was promised for the second half of 2026 and was not confirmed at the time of writing.
• How much was really taken in the 2025 breach.
• How accurate the inference system is, and how many adults it wrongly restricts.
• Whether age checks reduce harm to children. No results have been published.

Glossary

Age assurance

Any method a service uses to establish how old a user is, from asking to checking documents.

Age inference

Estimating a user's age from how their account behaves, without asking them for anything.

Facial age estimation

Software that guesses a person's age from a picture or video of their face. It estimates an age; it does not identify the person.

Online Safety Act

The UK law, passed in 2023, that requires online services to protect children from harmful content. Its age-check rules took effect in July 2025.

Teen-by-default

Discord's policy of giving every account teenage protections unless the owner is confirmed to be an adult.

Sources

1. Discord, "Adapting Discord for the UK Online Safety Act", 2025. discord.com Primary Search summary only · Accessed 3 October 2026 · Archived copy (27 Sep 2026) · Register R56
2. PinkNews, "Users claim Discord's age verification test can be tricked with video game characters", 25 July 2025. thepinknews.com Reporting Search summary only · Accessed 3 October 2026 · Search the Wayback Machine · Register R57
3. NBC News, "70,000 government ID photos exposed in Discord user hack", October 2025. nbcnews.com Reporting Read in full · Accessed 3 October 2026 · Search the Wayback Machine · Register R58
4. Wikipedia, "Discord". en.wikipedia.org Reference Read in full · Accessed 3 October 2026 · Archived copy (1 Oct 2026) · Register R40
5. Help Net Security, "Face scans and ID checks are coming to Discord", 10 February 2026. helpnetsecurity.com Reporting Read in full · Accessed 3 October 2026 · Archived copy (16 Jun 2026) · Register R59
6. TechCrunch, "Discord delays global rollout of age verification after backlash", 24 February 2026. techcrunch.com Reporting Read in full · Accessed 3 October 2026 · Archived copy (26 Aug 2026) · Register R60
7. FOX 4 Dallas-Fort Worth, "Texas forces Discord to implement UK-style age verification and safety rules", 27 July 2026. fox4news.com Reporting Read in full · Accessed 3 October 2026 · Search the Wayback Machine · Register R35

The state of the worldwide rollout at the time of writing was not confirmed. Check Discord's own announcements for the current position.