Hacker News new | ask | show | jobs
by mdavidn 136 days ago
It boggles my mind that they need a photo ID to prove that my 9-year-old account with a saved credit card belongs to an adult. The linked Steam account is 18 years old.
3 comments

from the article:

`For most adults, age verification won’t be required, as Discord’s age inference model uses account information such as account tenure, device and activity data, and aggregated, high-level patterns across Discord communities. Discord does not use private messages or any message content in this process`

they don't do this for age verification, they do this to build dataset to sell.
> Key privacy protections of Discord’s age-assurance approach include:

> On-device processing: Video selfies for facial age estimation never leave a user’s device.

> Quick deletion: Identity documents submitted to our vendor partners are deleted quickly— in most cases, immediately after age confirmation.

> Straightforward verification: In most cases, users complete the process once and their Discord experience adapts to their verified age group. Users may be asked to use multiple methods only when more information is needed to assign an age group.

> Private status: A user’s age verification status cannot be seen by other users.

Yes, I definitely trust the multi-billion dollar corporation regarding my data
Discord is an app that's so routinely reverse-engineered there are projects with a million+ users designed around patching changes to it, straight in the binary.

https://betterdiscord.app/

Do you think their big evil plan is to make up a lie that will last maybe 3 weeks, jeopardize the user trust and lose nitro revenue

Surely there is so much money to be made selling random people's faces.

If they tell you they're not selling your data they're not selling your data. What you should worry about is incompetence

Not even 6 months ago a third party they used for ID verification got breached

https://www.bbc.com/news/articles/c8jmzd972leo

> Do you think their big evil plan is to make up a lie that will last maybe 3 weeks, jeopardize the user trust and lose nitro revenue

???? Yes? Companies nuke their core product all the time for the sake of a big IPO number.

Of course discord has no track record of overextending their privacy policy and selling data you would not expect (sarcasm).

For example but not limited to "programs you run and other system specific information". I believe I read a while back they recorded titles of all opened windows but I can't seem to find a reference for that.

https://www.reddit.com/r/privacy/comments/rsxeee/you_should_...

I'm not saying they won't ever start collecting it and selling it. I'm saying the day they do, it will be laid out in their privacy policy. Right now they're making statements that they're not even collecting it.
Surely there is so much money to be made selling random people's faces.

I really hope I misread sarcasm in that statement. Because of course there is a lot of money in that

How much? 2 bucks per user?

Their paid users shell out 3 a month...

And then you think of the real world

> secretly selling your IDs data behind your back, they have to account for that revenue in their books, put it in their privacy policies or do it illegally, it's weak to whistleblowers, third parties get breached all the time (as well as yourself), and you have to trust the people you're selling this to. It's not credible.

Vencord is more patching Discord: https://github.com/Vendicated/Vencord

BetterDiscord is more... client modding to enable userscripts. Vencord is actually running find-and-replace on Discord's Webpack modules to implement deeper integrations. They're far more reverse-engineering than BetterDiscord's monkey-patching.

I think selling it to state actors lined could definitely be a big boon. I'll never trust them, I'd rather delete my account
Do you think they reverse engineer the server side?
Oh hey Direwolf I've contributed some stuff to your mods.

You mean if they lied about just the IDs but not the faces? The paragraph quoted mentions that the verification is done client side, "never leaves your device".

If we admit that they're saying they won't store it, then secretly selling your IDs data behind your back, they have to account for that revenue in their books, put it in their privacy policies or do it illegally, it's weak to whistleblowers, third parties get breached all the time (as well as yourself), and you have to trust the people you're selling this to. It's not credible.

There's similar debates with Whatsapp and their E2E encryption. Read this

https://blog.cryptographyengineering.com/2026/02/02/whatsapp...

Right, because that never happened to discord or any other multibillion VC fueled company that offers its services for free. See also meta repeatedly lying about absolutely anything that has to do with privacy.
> If they tell you they're not selling your data they're not selling your data.

Oh you naive child. /s

If they tell you they are not selling your data, its because they have a license agreement with another company which is selling your data. 'They' very specifically arent selling it, however they are very much profitting from other companies using it.

Yeah because they don’t haha. It boggles the mind because the headline is clickbait.
Youtube routinely asks for ID on accounts that are already of drinking age, they dgaf they want document scans they can use for profiling and to likely sell to 3rd parties.
> and to likely sell to 3rd parties.

Can you provide literally any evidence that would suggest this is the case?

Since selling PII is a common practice in the US industry, I believe the onus is reversed, they need to prove that they delete/keep-private.
Given how YouTube makes money from advertising, I suspect it's more profitable for them to keep the data to themselves and use it for targeting. I would not be surprised if they also share it with Adsense & other Alphabet entities (and presumably with government agencies), but am doubtful beyond that.

Not that this is much better than directly selling to third parties.

Yep, that's my reasoning too.
This sort of thing is common enough that simply establishing means, motive and opportunity are convincing to me. If not yet then soon. You can't hope for a smoking gun every time.
Give it a couple years for the inevitable data breach to leak all the details