Discord's age check, and the ID your teen uploads

Say the account goes first thing in the morning. A fourteen year old cannot get into Discord. Nothing was said in a server, no rule was broken. An automated system looked at the account and decided it probably belongs to someone under thirteen. The route back in is an appeal, and the appeal wants a photo of a government ID with the date of birth clearly visible.

That is the part of age checking nobody puts in a press release, and it is where the real exposure sits.

What Discord actually switched on

On 9 February 2026 Discord announced teen-by-default settings for new and existing users worldwide. Tighter limits on messages from people who are not friends, requests from strangers routed into a separate inbox, sensitive media left blurred, age-gated spaces shut unless you confirm you are an adult. Help Net Security noted the same day that only age-verified adults would be able to speak on stage in servers. A phased global rollout was set to begin in early March.

The age-checking half is behind schedule. After a loud backlash, Discord pushed the global launch of age assurance to the second half of 2026, and wrote in a follow-up post that it “should have provided more detail about our intentions and how the process works”. It had tested one vendor, Persona, in the UK during January 2026, then declined to move forward. Checks carry on where the law already demands them: the UK, Australia and Brazil.

Read Discord’s own account of the mechanism and it is genuinely careful. Over 90% of users, it says, “will continue using Discord exactly as they do today, with their age automatically determined through our existing safety systems and no additional action required”. Where a check does happen, facial age estimation is meant to run on the phone itself. “Facial scans never leave your device, and Discord and vendors never receive it. We only get your age group.” On documents: “IDs are processed to get your age only and then deleted.” And flatly: “Discord only gets your age. That’s it. Your identity is never associated with your account.”

If that holds, the scan is not the thing to lose sleep over.

The appeal is a different pipe

Here is what happened the last time the machinery was wrong at scale.

In October 2025 Discord disclosed that an attacker had compromised one of its third-party customer service vendors. Exposed data included names, Discord usernames, emails and other contact details, limited billing information such as payment type and the last four digits of a card, IP addresses, and the messages users had exchanged with support agents. It also included government ID images belonging to approximately 70,000 users. Discord’s own notice is clear about why that vendor held them: they were there to review age-related appeals. TechCrunch, reporting the breach, described what those appeals involve, a selfie taken while holding a government ID. The attackers claimed a far larger haul, 1.5 terabytes, which Discord called “incorrect and part of an attempt to extort a payment”.

Look at the shape of that. The age check is engineered to forget. The appeal is a support ticket, which means an attachment, a queue, an outsourced vendor, and a human being who has to look at the document to judge it. Two systems, two completely different privacy properties, and only one of them gets explained on a safety page.

The Electronic Frontier Foundation made the trust point plainly in February. Users, it argued, “are being asked to simply trust that this time will be different”, when the history of identity data is that it will leak, whether through breaches, misconfigured systems or retention that quietly outlives its purpose. EFF’s practical advice to anyone standing in front of an age gate is to hand over the least sensitive data possible.

Our own view, marked as ours: the climbdown was real and worth crediting. Discord slowed down, dropped a vendor, committed to on-device estimation and promised more documentation. But an automated age guess manufactures appeals by design, and the appeal is the one part of the system that cannot be made forgetful, because judging a passport is a job for a person.

The Singapore read

This is not a foreign story with local colour bolted on. In a factsheet dated 4 July 2026, MDDI set out plans to extend age assurance requirements to designated social media services, including “requiring them to keep users under 13 off their services”, with age-appropriate experiences and safeguards for older children. The Online Safety Commission began work in June 2026. We looked at the app store version of this gate in Singapore’s app store age checks, and the AI they miss, and at the gaming version in Roblox checks your child’s face now.

The ministry has been unusually frank about the ceiling on all of it. Answering a parliamentary question in October 2025, MDDI said that “age assurance measures are useful but insufficient”, and that “a child can still circumvent these measures, such as through using an adult’s account to access age-inappropriate content”.

There is a local footnote worth knowing. One of the vendor partners Discord names for regulated markets, k-ID, is headquartered in Singapore and Seattle, and raised a US$45 million Series A in 2024 from investors including Andreessen Horowitz and Lightspeed. Part of the plumbing behind these gates is being built here.

The better question

Age gates get argued about as though accuracy is the only question. For a parent, the more useful question is what the system does when it is wrong about your child, because that path is made of paperwork rather than code.

Three things follow.

• Put the real date of birth on the account now, while nothing is on fire. Nearly all of the ID exposure lives downstream of a wrong flag.
• If a check is ever demanded, take the on-device scan over the document upload where there is a choice.
• Treat anything typed into a support ticket as stored, not just the ID attached to it. That breach included the messages users sent to support agents.

We have a commercial stake in this, so we will say it plainly: Mentus AI is a mentoring product that handles children’s conversations, which puts us on the same hook as anyone else in this piece. The standard we would want applied to us is not “did you promise to delete it”. It is “how many copies exist, and who is holding them right now”.