Topic starter
25/08/2026 6:10 pm
TL;DR: Discord’s teen-by-default rollout and the backlash to its age-assurance choices show that face scans, government-ID uploads and behavioural inference can satisfy policy pressure while deepening privacy, bias and breach concerns, according to Trusona. The governance question is no longer whether platforms need age checks, but how to avoid turning verification into a data-harvesting layer that undermines trust.
Editorial analysis by NHI Mgmt Group, based on content published by Trusona: “I Don't Want to Scan My Face to Send Memes to My Friends”.
Key questions
Q: How should platforms verify age without collecting more identity data than necessary?
A: Platforms should use the smallest proof that satisfies the policy.
Q: Why do face scans and ID uploads create more risk than simple age checks?
A: They expand the control surface from a policy decision into a sensitive data-handling workflow.
Q: What are the signs that age verification is drifting away from a privacy preserving design?
A: Warning signs include collecting names or date of birth when they are not needed, retaining selfies after the age result is delivered, requiring account creation, or linking the age check to a broader identity profile.
Practitioner guidance
- Define the minimum age signal needed Specify whether the platform needs only an over-under-age result, not a government ID, face scan or full date of birth.
- Review third-party age-check vendors as processors Map what data they collect, how long they retain it, who can access it and whether deletion is technically verifiable.
- Replace biometric collection with claim-based attestations Use privacy-preserving verification flows that return eligibility only, so the platform does not store reusable identity artefacts.
Bottom line: Age assurance only stays proportionate when the platform proves eligibility without turning the user into a stored identity record.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Age assurance has become an identity governance problem, not just a child-safety feature. The article shows that once a platform starts collecting face scans, government IDs or inference data, it has created a regulated identity workflow with retention, access and third-party risk. That workflow must be governed like any other high-sensitivity verification process. The practitioner conclusion is clear: minimise the identity evidence behind age checks or inherit the security burden that comes with it.
A question worth separating out:
Q: Should organisations prefer behavioural inference or biometric checks for age assurance?
A: Neither is ideal if the system can avoid both. Behavioural inference still creates profiling and transparency problems, while biometric checks create stronger breach and trust risks. The better choice is the least invasive method that can produce a defensible age claim, with clear data minimisation and an auditable appeal path.
👉 Read our full editorial: Age assurance without face scans: privacy, trust and platform risk