Discord’s ID / age verification got hacked — we asked Xbox how it will avoid the same situation

by

As everyone predicted, the UK’s dumb age verification laws are a total farce.

The UK’s age verification laws, intended to shield children from inappropriate content, have backfired and created significant privacy concerns. They’ve led to websites like Imgur being blocked in the UK, and have reduced functionality on platforms like Reddit and Steam. Ironically, these laws don’t even achieve their stated goal of protecting children, as free VPNs easily bypass them.

Whether we like it or not, this is now the law, and unfortunately, it seems to be heading in a concerning direction. We’re seeing a global trend of age verification requirements, with many U.S. states and other countries already implementing or considering these systems. Because of this, companies like Microsoft are rushing to comply with the new rules for Xbox and their other services, relying on external companies to help them do so. However, whether these systems will actually work as intended remains to be seen.

Recently, Discord, a pioneer in implementing these kinds of security measures, experienced a data breach. The company failed to safeguard user information submitted through its age verification process. Hackers targeted a third-party service Discord uses, and as a result, government-issued IDs and selfies from users seeking support were publicly exposed. Many predicted this type of security issue could occur.

I was curious how Xbox will prevent similar issues, especially since they’re also using an outside company for age verification. I decided to ask them about their plans for handling this.

Microsoft uses Yoti to verify ages on Xbox. Yoti is also used by organizations like the UK government and platforms such as OnlyFans and PlayStation.

Yoti and similar services typically verify age by either scanning a government-issued ID or using your device’s camera to guess your age. While camera-based age estimation has been easily tricked in the past – famously by a feature in the game Death Stranding – companies are constantly working on ways to improve the technology and prevent these workarounds.

I easily confirmed my Xbox account’s age through the system – it was a simple process. You can do the same using this link. Starting in early 2026, UK Xbox users may lose access to some features and age-restricted games if they don’t verify their age soon. You might be wondering how it works and if your photos are saved. Yoti, the company handling verification, says they are not.

According to a Yoti representative, their age verification system helps Xbox players prove they’re old enough to play without sharing private details. Yoti only tells Microsoft ‘yes’ or ‘no’ to confirm if a user meets the age requirement.

Yoti’s technology is very reliable and has been rigorously tested by organizations like NIST. They prioritize privacy and security in everything they do, designing their solutions to collect as little data as possible while protecting user information. Importantly, any photos used for age estimation are immediately and permanently deleted – no data is saved.

Discord experienced a data leak because the age verification service it used, Yoti, was storing user data. Yoti claims it deletes personal information immediately after verifying age, and only sends that age verification to Microsoft, where it’s stored. For those interested in learning more, Yoti has published a detailed white paper explaining their age estimation process.

Microsoft clarified that they don’t store any personal data beyond a simple confirmation of whether or not a user passes the age verification check.

Microsoft is dedicated to protecting the privacy and security of player data. To help UK players confirm they are 18 or older, we’re working with Yoti, a well-respected identity verification service. This provides players with secure options while limiting the amount of personal data shared. Yoti only tells Xbox a simple yes or no, doesn’t share any personal details, and deletes the information immediately after verifying age.

Because Yoti works with governments on secure projects, it’s probably more secure than Discord. However, how comfortable you are with that depends on your own perspective. This doesn’t change the fact that the law requiring this is somewhat pointless and ineffective, but it *is* the law, and companies like Microsoft and PlayStation must follow it, even if they disagree.

Read More

2025-10-21 15:13