Security researchers investigating Discord’s age-verification implementation have discovered a publicly exposed frontend belonging to Persona Identities, Inc., revealing that the identity-verification vendor’s platform performs far more extensive checks than users of Discord, Roblox, or OpenAI’s ChatGPT were led to understand.
The exposed code was found on a US government-authorized server and contained 2,456 accessible files before being taken down. According to researcher Celeste (@vmfunc), the software executes 269 distinct verification checks – far beyond age estimation. The platform runs facial recognition against watch lists and politically exposed persons, screens users across 14 adverse media categories including terrorism and espionage, and assigns risk and similarity scores to each subject.
Persona collects – and can retain for up to three years – IP addresses, browser and device fingerprints, government ID numbers, phone numbers, names, biometric face data, and a range of selfie analytics including suspicious-entity detection, pose-repeat detection, and age inconsistency checks.
The disclosure arrived at a particularly sensitive moment. Discord had recently launched facial age verification trials using Persona in the UK and Australia, and Persona had positioned itself as a privacy-conscious actor, having recently joined the OpenAge Initiative alongside Incode and Veratad to advance reusable, privacy-preserving age credentials. The gap between that positioning and the scope of data collection revealed in the exposure has drawn sharp criticism from privacy advocates.
Discord announced it will not continue using Persona following the disclosure. The platform joins Roblox and OpenAI’s ChatGPT as confirmed users of Persona’s identity verification infrastructure. OpenAI’s help center had described Persona as a trusted third-party age verification company.
The findings raise questions for age verification policy globally: regulators in the UK, Australia, and elsewhere have pushed platforms toward mandatory identity checks, but the Persona exposure illustrates that the data footprint of such checks may significantly exceed what users or regulators anticipated.
Sources: Malwarebytes, CyberNews, The Rage
–
By the ID Tech Editorial Team
Follow Us