Discord Leaked 70,000 IDs Answering One Simple Question: Are You 18?

Seventy thousand people uploaded photos of their government I.D.s to Discord. They weren't applying for a job or opening a bank account. They were just trying to prove they were eighteen.

Those images sat with a third-party verification

Those images sat with a third-party verification vendor until they were exposed in a breach. Seventy thousand driver's licenses, passports, and national I.D. cards — leaked — because a chat app asked users to appeal an age-check error. If you've ever tapped "verify my age" on any platform, your documents may be sitting in a similar database right now. And if that thought makes your stomach tighten, good. That instinct is correct. But the fix isn't to panic. It's to understand why platforms collect far more information than they actually need — and to learn that a better path already exists. The question driving today's episode is simple. Why does confirming whether someone is over eighteen require handing over your full identity?

Picture walking into a bar. The bouncer needs to answer one question — are you old enough to be here? A quick look at your face or a glance at your I.D. settles it in seconds. Now imagine the bar photographs your driver's license, stores your full name, your home address, your date of birth, and your license number in a central database — and keeps it all for seven years. That's what's happening online. The information collected is wildly out of proportion to the question being asked. A yes-or-no age check turns into a full identity harvest.

So why do platforms do this? Most people assume there are only two options. Option one is the checkbox — "click here to confirm you're eighteen" — which everyone knows is meaningless. Option two is full document upload — scan your passport, send us a selfie, we'll match them. Regulators publicly reject option one as insufficient. That makes platforms afraid of legal risk, so they swing to the opposite extreme and demand everything. It feels like the only credible choice. But it's a false binary. There's a middle path that most people have never heard of.

Facial age estimation can actually answer the threshold question — over or under eighteen — without ever identifying who you are. According to N.I.S.T.'s Face Analysis Technology Evaluation, the best age-estimation algorithms achieve a mean absolute error of just one-point-three years for people between thirteen and seventeen. That means the system's guess is typically off by barely a year. And that's the age range where accuracy matters most. Ironically, estimation gets worse as people age. A forty-year-old who's avoided the sun might scan younger than a thirty-year-old who hasn't. But for a threshold check — simply "is this person over eighteen?" — that one-point-three-year margin is more than precise enough.

The key distinction is what happens to the data

The key distinction is what happens to the data afterward. A threshold check doesn't need to store your face. It doesn't need your name. It just needs to return a yes or a no — and then discard everything. That's a world apart from uploading your passport to a vendor's server and hoping nobody breaks in.

Google has taken this even further with a zero-knowledge proof solution. A trusted provider verifies your age on your own device — your phone does the math locally. Then it issues a cryptographic token. That token is a mathematical attestation that says one thing: "this user is eighteen or older." The website receives that token and nothing else. No birthdate. No name. No photo. Just a yes. For anyone who's worried about their identity floating around the internet, this approach answers the age question without creating a trail that can be stolen.

And theft is not hypothetical. When platforms outsource age verification to specialized vendors, they create concentrated repositories. A handful of companies end up holding scanned I.D.s and biometric templates for millions of users. One breach doesn't expose a few accounts. It exposes tens of thousands of identities simultaneously — exactly what happened with Discord. For professionals handling investigations or compliance, that concentration is a liability multiplier. For everyone else, it means the I.D. you uploaded to prove your age on one platform could surface in a data dump you never knew existed.

Meanwhile, this industry is accelerating. The global age-assurance market is projected to nearly double — from five-point-seven billion dollars in twenty twenty-five to ten-point-four billion by twenty twenty-nine. Every dollar of that growth locks in infrastructure: centralized databases, vendor networks, retention policies. Once that architecture is built, it becomes permanent. According to an open letter signed by four hundred and thirty-eight security and privacy researchers across thirty-two countries, age-verification mandates are technically impossible to get right, easy to circumvent, and likely to cause more harm than they prevent. The real danger isn't weak age checking. It's the permanent surveillance infrastructure that gets built in the name of protecting kids.