Age verification checks are now in force in the UK because of the Online Safety Act, but with the Discord fallout, it seems like one bad idea after another

Currently, I can't check my Bluesky direct messages until I've allowed the Epic Games-owned KWS to look at either my bank card, my ID, or my wizened visage. As I'm based in the UK, it's not just Bluesky I've got to worry about either, with similar verification processes now present on Reddit, Discord, and even my partner's Xbox.

This is all due to the Online Safety Act, which came into effect in the UK last year. For many, these age checks are an annoyance at best—but they also represent something that will have ramifications far beyond the British Isles. The UK's Act was designed in part to ensure children in the UK could not easily access "harmful content." This is a broad term that includes but is not limited to pornography, content that promotes "self-harm, eating disorders, or suicide," and "bullying".

To comply with the act and differentiate children from the adults, many platforms have opted for age-gates like the one I'm encountering on Bluesky. Almost 70% of Brits surveyed shortly after the Online Safety Act came into effect said they supported it…though 64% didn't think it would be all that effective. Indeed, I could log into a VPN to get past the UK-based Bluesky block—though unfortunately for me, I am stubborn, lazy, and cheap (apologies if you've been trying to get ahold of me).

Besides all that, I'm not especially keen to hand over my personal data to a third-party age verification vendor such as KWS for data privacy reasons. As recently as October, a Discord security breach may have leaked 70,000 age-verification ID photos. Discord's primary age-verification partner, K-ID, was keen to clarify that it was not involved.

As Jacob has previously outlined, there are better ways to implement age checks. As it stands, though, I'm not naive enough to think the data I keep elsewhere is in hands that are any safer. However, not submitting to an age assurance check makes for one less point of failure from which my likeness or even my official documents can leak out.

Discord first announced it would be using Brits as age assurance guinea pigs back in April 2025, but it turns out that may have all been prologue. Just in case you've been napping under a cool mossy rock for the last while, the social platform caused quite a stir this month when it announced it would be rolling out age verifying facial scans and ID checks globally this March. The case can be made that it is 'complying in advance,' as the UK's approach to online safety potentially serves as a preview for PC gamers further afield.

On the one hand, yeah, I'd rather children growing up today didn't see all the things I saw thanks to having unfettered internet access throughout the early oughts. I'd also rather young'uns now didn't have to experience all the harassment I experienced at the hands of my own peers, newly empowered by that unfettered internet access.

On the other hand, the internet answered a lot of questions I was absolutely not going to ask my parents; when I see a vague term like "harmful content" I do have to wonder what genuinely educational resources on the wider internet—say, regarding art history or personal health—might end up age-gated because someone somewhere has decided they're tantamount to 'pornography.'

I'm only just the other side of 30, but Section 28 was still in effect for some of my school years. For those who don't know, Section 28 was a law that prevented schools in England, Scotland, and Wales from doing anything that could be interpreted as "intentionally [promoting] homosexuality or [publishing] material with the intention of promoting homosexuality". So, until the law was repealed in the early 2000's, a lot of schools simply pretended LGBTQIA+ folks didn't exist. The internet, for all of its faults, helped to fill that deafening silence for me.

Even so, I remember there being content blocks back in my day, too, and I know I found more than a few ways around those. Indeed, if we take just Discord today, our James has found not one but two different ways to fool its face scans—though the platform may already be formulating a counter to these workarounds.

Shortly after issuing assurances that not all users will even have to undergo an age check, a since-edited support article revealed that some UK users "may be part of an experiment where your information will be processed by an age-assurance vendor, Persona." Amid reports of folks easily fooling its primary third-party vendor's age verification checks, Discord may have been seeking to diversify its defences.

Persona's investors include Peter Thiel, co-founder of ICE's premier surveillance provider, Palantir. Though Persona and Palantir are two totally separate companies that do not share either data or operations, that's still a pretty grimy connection. Not least of all because earlier this week, the US Department of Homeland Security reportedly subpoenaed a number of major online platforms—including Discord, Reddit, Google, and Meta—in order to obtain the personal details of accountholders who had been critical of ICE or identified the locations of its agents. We don't yet know if Discord complied, though we have reached out for comment.

There is an even worse wrinkle in the Discord-Persona 'experiment': while Discord had previously said that data like age verification face scans would only be stored and processed on users' own devices, those who ended up part of the Persona experiment may have their information "temporarily stored for up to 7 days, then deleted."

Indeed, some security researchers are already claiming to have "found a Persona frontend exposed to the open internet on a US government-authorized server."

All of that said, Persona is not part of Discord's long-term strategy, with the platform telling Kotaku earlier this week that its dealings with the vendor were part of a "limited test" that has since been concluded. That leaves K-id's on-device processing in effect, but even that doesn't necessarily end the privacy nightmare. Data breaches usually leave platforms scrambling for user good will, but Discord seems all too happy to keep walking into rakes.

One could jump ship and shop around for a free Discord alternative as I recently did, but all of the platforms I tested will likely have to implement some sort of age assurance check if they haven't already in order to continue serving users based in the UK in the future. That doesn't mean I'll be letting them scan my face any time soon; I may have to deploy Norman Reedus and his funky foetus before long as third-party age verification vendors have done little to earn my trust or a gander at my actual face.