Did you upload your ID?
Last October, Discord emailed about 70,000 people to tell them photos of their government IDs had been stolen. Discord didn't get hacked, but their support vendor did. It was one of those third-party companies that handles customer service tickets. And users IDs were sitting there because they had been flagged as maybe being underage and they had to prove they weren't.
So... passports, licenses, names, emails and IP addresses (which is a pretty good approximation of what town you live in) were all just sitting there for the taking.
And then... five months later, Discord turned on mandatory age verification worldwide, for everybody. According to them, you're a teenager by default until you prove otherwise (using a government ID or a video selfie so an AI can estimate your age off your face). So... they leaked a bunch of IDs in October and started collecting everyone's in March. Cool, cool, cool.
And it's not like Discord is uniquely bad at this or anything... that's just what compliance looks like right now... and Congress is about to require a whole lot more of it.
Four bills moved in the last 6 weeks:
- The Kids Online Safety Act (KOSA) covers regulating social media and other online services for kids. It's got a lot of support (76 cosponsors and the full Senate has already passed a version of it 91-3 in 2024) and it cleared the Senate Commerce Committee on Aug 5th.
- The CHATBOT Act would require every AI chatbot to build a family account system to allow parents to monitor activity. This one also moved forward on the 5th.
- The Youth AI Privacy Act would require AI companies to create kids-only privacy rules and it also moved forward.
- The SCREEN Act would require age verification before using sexually explicit sites and it's the one to watch. It got a 15-13 vote to advance. It still didn't make it out of committee, but only because not enough senators showed up in person, so it needs a revote.
Some of the biggest concerns for you, as a creator:
- Creators sit on both sides of the SCREEN Act. It doesn't have a threshold that requires a certain amount of the site be explicit (one item can trigger the requirement), so you could potentially become responsible for the age verification of your users in your Discord community, your Circle community, your comment area.
- The SCREEN Act also attacks your ability to use VPNs. That turns something that's a great privacy tool now into a verification trigger.
If these bills get passed, every platform you rent your reach from becomes a place that your legal identity now lives.
|
The pattern we keep seeing
When a law makes someone responsible for checking your ID, the checking gets outsourced almost immediately. Your ID ends up with some third-party company that you didn't choose and can't opt out of.
|
| 02 |
Why the system allows it |
Nobody is responsible for your ID
How do you tell if someone is a minor? You have to check their ID, right?
But you can't check just the minors... you have to check everyone.
There's no way to look at an account and know that it belongs to a 15 yo. So the only way to keep minors out is to make every single person prove they aren't one. Most of these bills don't say "upload your license" and some of them will let platforms guess your age from a face scan (which is just biometric collection with extra steps) or your device signal instead (least bad option on the table but still means that someone's logging you got checked). But when those tools guess your age wrong, or the platform doesn't believe it, the fallback is always the ID.
So every path through this eventually ends up at your ID.
Ok... so who's holding all that?
Welp, it's not Congress. They write the requirement and go home.
And it's not the platform either. Discord didn't build an ID verification system, they bought one and routed the appeals through an outside support company. Because that's what every platform does when they get hit with a compliance requirement. Verification is a product now (and a lucrative one). There's a whole industry selling it and that industry's revenue requires laws like this to pass.
And it's definitely not the vendor. That company doesn't have any kind of relationship with you. You didn't pick them, you can't choose to leave them, and you probably don't even know they exist unless you're a nerd who reads privacy policies and terms of service. Their customer is the platform. You're just the file.
Look, these bills might come from a place of genuine concern about protecting kids. Who doesn't want that? But sincerity isn't a security control and the architecture of the bills still produces the same result... that everyone has to be verified and everyone has to produce an ID to do it.
So the liability sits in one place, and your driver's license sits in a different one. Discord leaked 70,000 IDs and then expanded that ID collection to its whole user base five months later. And, as far as I can tell, nothing bad happened to Discord. Because, structurally, it wasn't supposed to.
| 03 |
How to protect yourself anyway |
Control what's behind your ID
Your ID isn't dangerous by itself. It's dangerous because of what it's attached to. Your legal name and your home address, sitting in some random vendor's ticketing system, next to an IP address that says what city you're in. The damage from a leak like Discord's depends almost entirely on what someone can find when they search that name. And that's the part you can control.
- If you get a choice, take the least permanent option. Some platforms can verify you through your phone's operating system or app store instead of collecting your ID. It's not perfect, but it IS meaningfully better than handing a jpeg of your license to some random company to do with it whatever they will.
- Call your reps. These bills aren't law yet. EFF's tool to help you contact your reps takes about 90 seconds. So, contact your reps and tell them to vote no on these bills.
- Clean your name ahead of time. Check your voter registration first (some states let you suppress it, and most will let you if you've been harassed or stalked). Then your county property record. Then whichever data broker sites come up when you search your name. If your legal name doesn't lead anywhere, a leaked ID is an annoyance instead of a doxx.
|
On the Radar
|
What we're watching
|
|
From Unpublic HQ
|
Pre-Order Shadow
Shadow is the system we run with our one-on-one clients, rebuilt so you can run it yourself.
It's personalized to you, your content, your platform and your location and walks you step-by-step through locking down your public information so that you can be seen by millions, but found by no one.
Pre-Order Shadow →
|
|
|
Stay safe,
Susan @ Unpublic
|
|
You're getting this because you signed up at unpublic.co.
Unpublic, PBC. · 600 1st Ave Ste 330 PMB 92768 · Seattle, WA 98104-2246
|
