Discord Wants Your Government ID. They Just Leaked 70,000 of Them.

TL;DR: In March 2026, Discord will require all users to verify their age through face scans or government IDs, or lose access to age-restricted content and full messaging features. Four months ago, hackers stole at least 70,000 government ID images from a Discord verification vendor. Discord says trust them, the new system is secure. Privacy groups say mandatory ID collection is a disaster waiting to happen.

What Discord Is Doing

Starting in early March 2026, Discord flips the switch on mandatory age verification worldwide. Every user (new and existing) gets classified as a teen by default until they prove otherwise ^[1][2].

You have two options to verify:

Government ID: Upload a photo of your driver’s license, passport, or other government-issued identification.
Face scan: Record a video selfie. AI estimates your age from your face.

Some users may be required to use both methods “if more information is needed to assign an age group” ^[2].

If you don’t verify, you’re locked out of:

Age-restricted channels and servers
Direct messages from people not on your friends list
Sensitive content (blurred by default)
Full platform functionality

Discord calls this “teen-by-default settings.” Privacy advocates call it mandatory biometric surveillance.

About That Data Breach

Here’s the context Discord would rather you forget.

On October 3, 2025, four months before this global rollout, Discord disclosed that hackers breached 5CA, a third-party vendor handling age verification appeals ^[3][4]. The attackers, calling themselves “Scattered LAPSUS$ Hunters,” maintained access for 58 hours after compromising a single support agent’s account ^[5].

What they got:

At least 70,000 government ID images submitted for age verification appeals ^[3][4]
User names, Discord usernames, and email addresses
Support conversation transcripts
IP addresses from support interactions
Limited billing metadata (last four digits of cards)
Internal corporate training materials

Conflicting reports suggest the breach may have been worse. Some analyses indicate up to 5.5 million users affected, with 2.1 million ID photos stolen ^[5].

The attackers demanded $5 million in ransom. When Discord refused, they dropped the price to $3.5 million. Discord still refused to pay ^[5].

Good for Discord, bad for the 70,000+ people whose government IDs are now in criminal hands.

The Timing Couldn’t Be Worse

Discord’s solution to a breach that exposed ID photos from age verification: expand age verification to every user on the platform.

The breach happened because Discord outsourced ID handling to a third-party vendor with weak security. A single compromised account gave attackers access to the entire support ticket environment. One employee. 58 hours. 70,000+ IDs ^[4].

Discord’s new system uses k-ID as a verification partner ^[6]. They promise “quick deletion” of identity documents: “immediately in most cases after age confirmation.” ^[2]

5CA probably made similar promises.

Discord’s Privacy Claims, Examined

Discord’s head of product policy, Savannah Badalich, says the system “builds on Discord’s existing safety architecture, giving teens strong protections while allowing verified adults flexibility” ^[1].

Here’s what they claim about privacy:

“Video selfies never leave your device.” The face scan uses on-device processing for age estimation. Discord says no biometric data is stored or transmitted ^[2].
“ID documents deleted immediately.” Government IDs submitted to k-ID are supposedly deleted right after verification ^[2].
“Verification status invisible to other users.” Nobody sees whether you verified with ID or face scan ^[2].

But here’s what they don’t mention:

The October breach exposed IDs collected through a previous verification system using the same model: third-party vendors handling documents.
“Immediately deleted” doesn’t mean the data can’t be intercepted in transit or accessed before deletion.
Discord still runs an “age inference model” in the background. Some users will be flagged for verification even without triggering it themselves ^[2].
If the system suspects you’re lying, you may need to provide both face scan AND government ID.

Why Age Verification Is Fundamentally Broken

The problem isn’t just Discord. It’s age verification itself.

The EFF published a breakdown of 10 dangers with mandatory age verification in December 2025 ^[7]. The highlights:

15 million U.S. adults lack driver’s licenses. 2.6 million have no government photo ID at all. 34.5 million don’t have ID with their current name and address. These populations skew Black, Hispanic, low-income, and disabled. Age verification locks them out ^[7].

AI age estimation is racially biased. These systems show documented higher error rates for Black, Asian, Indigenous, and Southeast Asian faces. Adults get misclassified as minors. Unequal access based on skin color ^[7].

Transgender people face impossible choices. 43% of transgender Americans lack ID reflecting their correct name or gender. Age estimation fails more often on trans faces. You either out yourself by submitting mismatched ID or lose platform access ^[7].

Anonymity dies. Every age verification system is a surveillance system. Domestic abuse survivors hiding from abusers. Journalists protecting sources. Activists avoiding retaliation. All exposed when ID verification becomes mandatory ^[7].

Data breaches keep happening. AU10TIX, a major age verification vendor, was breached. Discord was breached. Every honeypot of government IDs is a target ^[7].

Why This Is Happening

Discord isn’t doing this because they want to. They’re doing it because governments are forcing their hand.

The UK’s Online Safety Act requires age verification for platforms with adult content. Australia passed similar laws. The Netherlands, Spain, and France are following ^[1][6].

Discord’s choice: implement global age verification or lose access to these markets.

So they’re rolling out ID checks worldwide (even in countries that don’t require it) because running separate systems is expensive.

The result: regulatory compliance theater that makes everyone less safe. Governments get to claim they’re “protecting children.” Companies get legal cover. Users get their IDs stolen.

What You Can Do

Use the Face Scan If You Must Verify

If Discord’s claims are accurate, the face scan processes on-device and deletes immediately. That’s better than uploading a government ID to third-party servers. Both options are bad. One is worse.

Consider Alternative Platforms

Matrix (with Element client), Signal group chats, and other platforms don’t require ID verification. Communities can migrate. It’s not easy, but it’s possible.

Document What You’re Forced To Submit

Screenshot everything. Note the date and time. If there’s another breach, you’ll have records for any legal action. Check HaveIBeenPwned.com periodically for your email addresses.

Support Privacy Organizations

The EFF, ACLU, and EPIC are fighting age verification mandates in courts. They need funding to challenge laws that force companies to collect your ID.

The Real Problem

Discord had a data breach that exposed tens of thousands of government IDs. Their response: collect government IDs from everyone.

This isn’t safety. It’s compliance theater that makes users less safe while giving Discord legal cover.

The system that leaked 70,000 IDs wasn’t fundamentally different from the system Discord is rolling out. Third-party vendors. Document handling. Promises of quick deletion. We’ve seen how that ends.

When Discord asks for your ID next month, remember: they lost 70,000 IDs four months ago. They’re asking you to trust that this time will be different.