Researchers exploring Discord’s age-verification mechanisms have uncovered significant privacy concerns related to the identity-verification vendor, Persona. This investigation revealed that a publicly accessible Persona frontend was found on a U.S. government-authorized server, exposing thousands of sensitive files that detail an extensive surveillance and financial intelligence system, far beyond a mere “teen safety” feature.
Recently, Discord announced it would restrict user profiles to a mode suitable for teenagers until age verification is confirmed. This change mandates users undergo facial scans to continue using the platform, which has sparked considerable backlash from the internet community.
To perform these biometric identity checks, Discord collaborates with Persona Identities, Inc., a startup specializing in Know Your Customer (KYC) and Anti-Money Laundering (AML) solutions that utilize biometric technology to ascertain users’ ages. The researchers highlighted the implications of this partnership, noting the considerable amount of data collected by Persona—which can be stored for up to three years. This collection includes IP addresses, device information, government identification details, and biometric data such as facial images.
Among the findings, researchers concluded that Persona’s software conducts an astonishing 269 different verification checks, including running facial recognition against watchlists and assessing risks associated with users based on various media categories.
At a time when concerns about privacy and data security are heightened, the news of Persona’s extensive data collection practices has raised alarms among privacy advocates, especially regarding the potential sharing of this data with third parties, including foreign governments. Despite these concerns, the reality of online age verification continues to be scrutinized. For instance, Australia’s recent regulations banning social media access for users under 16 have reportedly resulted in millions of account terminations. However, anecdotal evidence suggests that many young users still find ways to circumvent these restrictions.
In light of these revelations, Discord has recently announced that it will no longer utilize Persona for its age verification processes. Nonetheless, other platforms, including Roblox and OpenAI’s ChatGPT, have been reported to use Persona’s verification systems as well.
These developments bring to light the ongoing debate surrounding age verification and its efficacy in protecting young users. As privacy issues continue to unfold, there is a growing call for more transparent and secure methods of verification that prioritize user safety without compromising their personal data.