Discord Wants to Know How Old You Are. Who Else Ends Up With Your ID?

What Discord collects about you

Discord is free to use, and like most free platforms it runs on data. Its privacy policy lists a broad range of information it gathers, either because you hand it over or because the apps collect it automatically:

According to independent analyses of the policy, this data can be used not only to run the service and enforce safety rules, but also for advertising, analytics and product development, and it may be shared with partners in those categories. None of that is unusual for a large platform, but it matters more once that same account history starts being used to decide how old you are.

The 2025 breach: when “a third party” had your ID

On September 20, 2025, attackers gained access to a third-party customer service provider that Discord used for support tickets. Discord disclosed the incident in early October and later confirmed that about 70,000 users may have had government ID photos exposed. These were images those users had submitted when appealing an age-related decision. Some users’ names, email addresses, IP addresses, support conversations and partial payment details (last four digits, no full card numbers) were also affected.

The attackers claimed a much larger haul (millions of records and over two million ID images) and demanded a ransom. Discord disputed those numbers, refused to pay, cut off the vendor’s access and brought in forensic investigators. The vendor widely named in reports denied it was responsible, so who exactly held the data remains contested.

How Discord’s new age verification works

Discord first announced in February 2026 that it would require age verification worldwide starting in March, primarily through face scans or ID uploads. After a strong backlash, fuelled by the breach, it postponed the plan, dropped one verification vendor it had been testing in the UK, and promised to publish which companies would handle verification.

1. Sept 20, 2025Third-party support vendor breached; ~70,000 ID photos exposed.
2. Dec 2025“Teen-by-default” settings and age checks introduced in Australia.
3. Feb 2026Global age verification announced for March, then delayed after user backlash.
4. Mar 2026Age assurance proceeds in Brazil to meet local legal requirements; Texas follows.
5. Sept 23, 2026Global rollout begins (outside the UK and Australia, which keep their own processes).

Step 1: Discord guesses your age from your account

Every account is now automatically placed in an age group based on account signals, such as how long the account has existed, which servers you belong to, connected games and general activity. Discord says it doesn’t read your messages or calls to make that call, and expects more than 90% of users won’t have to do anything. You can see your status under Account Status in settings.

Put plainly: your behaviour history is now being used to infer a personal characteristic about you. If the model gets it wrong, you can be locked into teen restrictions (blurred content, limited DMs, no access to age-restricted servers) until you prove otherwise. Within a day of launch, Discord’s own status page logged a major incident involving age status not matching across devices.

Step 2: If you’re “unconfirmed” or wrongly flagged, you verify

Available options depend on your region and device:

To be fair, this version is a real improvement over the original plan: most adults will never be asked, and there are now options that don’t involve your face or a passport. But the ID route still sends one of your most sensitive documents through a chain of outside companies, each with its own systems, staff and retention practices. “Deleted after verification” is a promise. The 2025 breach is exactly what happens when a promise like that and reality drift apart.

Why this matters for communities and businesses

• You don’t control the rules. Your community’s access can change overnight because of a law in another country or a model’s guess about a member’s age.
• Moderators can lose access. An adult moderator misclassified as a teen can be blocked from the very spaces they run.
• Your members’ data isn’t yours. Every message, file and voice log lives on a platform whose policy allows analytics and ad use.
• Third-party risk multiplies. Support desks, verification vendors and payment processors each add another place data can leak.

For a gaming group, a club, a local business team or a family, the answer isn’t necessarily to quit chat. It’s to own the platform you chat on.

The alternative: self-host Fluxer

Fluxer is a free, open-source chat platform built in Sweden that deliberately mirrors the Discord experience. It’s licensed under AGPLv3, so the code can be audited by anyone, and it’s funded by its community and optional subscriptions rather than ads or investors. The project states it doesn’t sell user data.

What you get

• Communities (servers) with organized text channels, threads and replies
• Private DMs and group chats
• Voice and video calls with screen sharing, joinable from multiple devices
• Roles, granular permissions, invites and moderation tools
• Custom emoji and stickers, file uploads with previews, link embeds and full-text search
• Custom CSS themes, compact mode and 30+ languages
• Bots and webhooks
• Desktop apps, a web client, and a mobile app in beta, all of which can connect to your own instance

Why self-hosting changes the equation

Fluxer runs a hosted service at fluxer.app with an optional paid tier called Plutonium ($4.99/month or $49.99/year). But the bigger story is that you can run the whole backend yourself, and on a self-hosted instance, nothing is paywalled. Every feature is included, and you set your own limits from the admin panel.

What self-hosting actually involves

Fluxer is still in public beta, so be realistic about the effort. Its full self-hosted stack has historically been heavy (around 25 containers), though the developers have been working toward a much lighter setup built around a TypeScript server, an Erlang gateway and optional LiveKit for voice and video. A community-maintained Railway template condenses it to 13 services, but it switches voice and video off because that platform can’t receive UDP traffic.

A solid production setup looks like this:

• A server with UDP open: a VPS or on-prem box, so voice and video (LiveKit) work properly
• Your own domain (e.g. chat.yourcompany.ca) with HTTPS certificates
• S3-compatible storage for attachments and avatars
• Secrets stored safely, since changing root secrets later logs everyone out or breaks upload links
• Automated, off-site backups of the database and files
• Pinned versions and planned updates, since a beta moves quickly
• Monitoring so you know before your members do when something’s down

Other open-source options worth knowing

Want your own private chat server, without the setup headache?

Razenet is a family-run IT company in Red Deer. We already handle hosting, domains, business email and IT support for local businesses and individuals, and we can do the same for your community chat:

• Plan, deploy and secure a self-hosted Fluxer (or alternative) server
• Connect it to your own domain with HTTPS
• Set up backups, monitoring and updates
• Help your members move over and get comfortable

Talk to Razenet

×

Contact Us

reach out and start a conversation!

Leave this empty

Email *

Full Name *

Number

Message *

This form is protected by reCAPTCHA.

Submit