- Discord is reportedly testing identity verification firm Incode for age verification, raising fresh questions over biometric data handling.
- The reported trial follows last year’s exposure of about 70,000 government ID images during a breach involving a third-party verification provider.
- Privacy advocates say users need greater transparency as governments push platforms toward stricter online age verification requirements.
Discord has reportedly started testing identity verification company Incode as a potential age verification provider. The reported move has already sparked fresh debate over biometric privacy and third-party data handling.
International Cyber Digest first shared the report on X. The cybersecurity news account claimed Discord has begun evaluating Incode as part of its age verification process.
The reported partnership comes at a sensitive time. Discord still faces scrutiny after a previous incident exposed thousands of users’ government identification documents through an external service provider.
Privacy advocates now question whether another identity verification vendor could introduce similar concerns. They argue that biometric information deserves stronger safeguards, especially when outside companies process sensitive personal data.
Discord’s Reported Incident Trial Revives Privacy Debate
Discord has previously explained that its selfie-based age verification system processes facial age estimation directly on a user’s device. According to the company, selfie images never reach Discord’s servers during that process.
The company also says users who must verify their age with official identification submit those documents through approved verification providers. Discord says those documents are removed once age verification finishes.
However, critics argue that Discord’s own practices tell only part of the story. They say users must also understand how third-party providers handle collected information. According to Incode’s published biometric privacy policy, the company may retain biometric information for as long as three years after a person’s last interaction, where local laws permit it.
The policy also explains that retention periods may differ because of legal obligations or contractual requirements. Another section has attracted even greater attention. According to Incode’s documentation, the company may also use biometric information to improve artificial intelligence models when users have given their permission.
Those disclosures have prompted fresh concerns among privacy advocates. They believe many users may not fully understand how consent agreements affect the future use of biometric information.
Some experts also warn that vendor privacy policies deserve as much scrutiny as platform policies. They argue that outsourced verification shifts responsibility without eliminating privacy risks.
Discord has not publicly confirmed whether Incode will become its permanent age verification provider. The reported testing nevertheless places the company’s verification strategy under renewed public attention.
Previous Government ID Exposure Still Shapes Public Trust
The reported evaluation has also revived memories of Discord’s previous identity verification incident. Last October, attackers compromised a third-party customer support provider involved in Discord’s verification process. The incident reportedly exposed government identification images belonging to around 70,000 Discord users.
The breach did not originate from Discord’s own infrastructure. Even so, the incident damaged confidence in third-party identity verification services. Reports indicated that exposed files included passports, driver’s licenses, and other government-issued identification documents.
The scale of data breaches affecting user information is evident in other sectors; hackers have claimed a Korek Telecom data breach affecting 750,000 subscribers.
Privacy advocates argued that platforms should carefully reconsider whether outside companies should process highly sensitive personal records. Many users continue referencing that incident whenever Discord discusses identity verification. They worry another external provider could create similar risks regardless of Discord’s own security controls.
Discord has acknowledged growing skepticism surrounding online age verification. Earlier this year, the company delayed the wider rollout of its global age verification program after criticism from users and privacy campaigners.
The company also pledged to improve transparency surrounding the third-party providers participating in its verification process. That commitment has become increasingly important as more governments introduce regulations requiring digital platforms to confirm users’ ages before allowing access to certain online services or content.
Governments Push Age Checks While Users Demand Transparency
Technology companies now face growing pressure to balance regulatory compliance with user privacy. Many governments have introduced child safety laws requiring online platforms to verify users’ ages before granting access to age-restricted features.
Those requirements have increased demand for specialized identity verification companies. Privacy specialists, however, say compliance should not come at the expense of transparency.
They argue that companies often promise limited data collection while relying on outside vendors whose own policies determine how long personal information remains stored and how it may later be used.
According to Discord, facial age estimation remains local to a user’s device rather than being uploaded to company servers. The platform also maintains that identification documents submitted through approved providers are deleted after verification concludes.
Even with those assurances, critics believe users deserve clearer explanations about every company involved in the verification chain. They also want platforms to explain how consent is collected, how biometric information may be retained, and under which circumstances artificial intelligence systems may access that information.
The reported Incode testing highlights those unanswered questions. Discord has not announced any permanent agreement with the identity verification company at the time of writing. The reported trial nevertheless illustrates the growing tension between regulatory obligations and user expectations.
For many Discord users, the discussion has expanded beyond age verification itself. The larger concern now centers on trust. Users increasingly want confidence that every company handling their identification documents or biometric information follows strict privacy standards before that data ever changes hands.
