Discord is attempting to distance itself from the age verification provider Persona following a steady stream of user backlash. In an emailed statement to The Verge, Discord’s head of product policy, Savannah Badalich, confirms the company “ran a limited test of Persona in the UK where age assurance had previously launched and that test has since concluded.”
An archived version of Discord’s support page stated that users in the UK “may be part of an experiment” that involves processing their age verification information through Persona. Users pointed to Persona’s privacy policy, which states that it may obtain personal data from users through “third party databases, government records, and other publicly available sources.” Discord removed the mention of Persona from its support page on or around February 15th, according to an archived version of the site. Persona CEO Rick Song tells Ars Technica that it deleted the information collected as part of Discord’s test immediately after verification.
Amid privacy concerns surrounding Persona, a report from the independent publication called The Rage highlighted findings from three security researchers, who discovered exposed code “at a US government authorized endpoint,” along with 2,456 files showing an interface “that pairs facial recognition with financial reporting.” However, Persona CEO Rick Song confirmed to Ars Technica that the company doesn’t have any government contracts, while The Rage notes that the exposed code “appears to be powered by an OpenAI chatbot.” Song is in active communication with one of the researchers who discovered the exposed code, which has since been removed.
Aside from Persona, Discord has only specified its use of k-ID for age verification, which says its technology enables facial age estimation scans and can support ID scan verification through a company called Veratad. Discord maintains that the age estimation technology used for face scans will run locally on your device without uploading your video selfie, but doesn’t include that language for “identity documents and ID match selfies:”
Discord and k-ID do not permanently store personal identity documents or your video selfies. Images of your identity documents and ID match selfies are deleted directly after your age group is confirmed, and the video selfie used for facial age estimation never leaves your device.
”We’re regularly evaluating vendor partners to improve our age assurance experience and expand user options while prioritizing privacy,” Badalich says.
According to Discord, the “vast majority” of users won’t have to verify their age on the platform, either because the machine learning model they use to estimate age based on existing account info, device, and activity data determines it’s not required, or because the user hasn’t accessed settings or content that raises the flag. If Discord can’t determine that someone is an adult with “high confidence,” they’ll be placed into a “teen” experience by default, which blocks access to age-restricted channels and servers and puts filters on sensitive content, unless they verify their age, which could include some mix of face scan or photo ID submission.