Security researchers claim Persona, the provider behind Discord's UK age verification 'experiment', performs '269 individual verification checks' on user data, including those for terrorism and espionage

(Image credit: Getty Images)

Discord's age verification rollout has been met with... shall we say, dismay by many users of the platform, with many hunting for a better, more privacy-focused alternative.

The news was even less well-received when Discord informed some UK users that they may be part of an "experiment" with an age verification provider called Persona, the lead investor of which, in its most recent rounds of capital funding, was a venture fund co-founded and directed by none other than Peter Thiel.

"We didn’t even have to write or perform a single exploit, the entire architecture was just on the doorstep," claims the team.

Person typing on a laptop with red and blue lighting — (Image credit: Westend61)

"53 megabytes of unprotected source maps on a FedRAMP government endpoint, exposing the entire codebase of a platform that files Suspicious Activity Reports with FinCEN, compares your selfie to watchlist photos using facial recognition, screens you against 14 categories of adverse media from terrorism to espionage, and tags reports with codenames from active intelligence programs.

"2,456 source files containing the full TypeScript codebase," the blog continues. "Every permission, every API endpoint, every compliance rule, every screening algorithm. Sitting unauthenticated on the public internet. On a government platform no less."

Beyond the astonishing thought that such data could be accessed so easily, it certainly seems like Persona operates more deeply than anyone would reasonably expect. The researchers say that the full verification program performs 269 individual verification checks across 14 check types, including "SelfieSuspiciousEntityDetection".

"What makes a face 'suspicious?'", say the researchers. "The code doesn't say. The users aren't told."

The process for verifying your age on Discord using Death Stranding — (Image credit: Future)

What we're often told, however, is that age verification is in our best interests, in an effort to prevent children from watching harmful content. Still, it doesn't take a genius to realise that there's a whole lot more value in facial recognition data than simply verifying that someone's old enough to view adult material.

How much of this leak applies to Discord's earlier testing is unclear. However, it's an excellent example of why privacy advocates have been vocally uncomfortable with the idea of current digital age verification methods, and why you should be very, very picky about who you hand your data over to. If, let's be honest, anyone at all.

Best gaming rigs 2026

1. Best gaming laptop: Razer Blade 16

2. Best gaming PC: HP Omen 35L

3. Best handheld gaming PC: Lenovo Legion Go S SteamOS ed.

4. Best mini PC: Minisforum AtomMan G7 PT

5. Best VR headset: Meta Quest 3

👉Check out our list of guides👈

Andy built his first gaming PC at the tender age of 12, when IDE cables were a thing and high resolution wasn't—and he hasn't stopped since. Now working as a hardware writer for PC Gamer, Andy spends his time jumping around the world attending product launches and trade shows, all the while reviewing every bit of PC gaming hardware he can get his hands on. You name it, if it's interesting hardware he'll write words about it, with opinions and everything.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.