Discord age assurance vendor trial raises questions about transparency

Discord is trialing Incode for both facial age estimation (FAE) and document-based age verification. Singapore-based compliance orchestration firm k-ID remains a named age assurance partner for video selfie verification and ID scans.

The move comes after Discord faced significant user pushback to an initial deployment of biometric tech from Persona, forcing it to backpedal on the partnership. The fallout included concentrated attacks attempting to breach Persona’s system. Those failed – but the new arrangement will surely fuel more speculation from users that make it their business to interrogate age and identity tools, particularly those perceived to be associated with Silicon Valley.

What they will find is a complicated picture of an age assurance industry in flux, as various connections are made and broken, technologies overlap, and startups roll out different models to try and stake out market share.

‘Subprocessors’ actually perform biometric processes

Discord’s announcement is simple enough on the surface. A notice on the platform’s website says that between June and July 2026, it is “testing a few new age assurance methods including Google Wallet and credit card check to provide more options for the small percentage of users who may need to manually age assure. We will also be testing ID scan and Selfie methods with a new vendor, Incode, who meets our strict requirements for on-device facial age estimation so your biometric data never leaves your phone.”

For now, Discord’s main provider of facial age estimation is k-ID. Per the site, a selfie scan is “processed by k-ID, our age assurance vendor.”

Here, language once again becomes a load-bearing hinge. While k-ID facilitates age assurance, it is technically an orchestration platform, not a biometrics vendor with its own algorithm. While it  may “process” the selfie, the technology it uses to analyze facial features on-device is provided by external vendors – or, in the lingo of k-ID’s privacy policy, “subprocessors.”

According to k-ID’s privacy policy, it offers “multiple third-party FAE solutions for our customers to comply with laws that require age assurance.” It highlights facial age estimation from Privately, which runs on-device, using various age signals to return a “vector” to the relying party. “Neither k-ID nor its service providers collect any photos or other biometric information from you as part of this process,” says the policy. “Regardless of what method you choose, k-ID does not receive the information you provide to prove your age status. We only receive the results of the process.”

k-ID also led the launch of the reusable age check system OpenAge Initiative in November 2025, which counts Persona, Incode and Veratad among the companies in its network.

Incode ‘experiment’ too vague

k-ID’s data privacy commitment is all well and good, and makes sense in terms of the firm’s business model, which is ultimately built on regional flexibility for compliance and user choice in age settings. The point is to be nimble enough to be able to orchestrate compliance regardless of regulatory jurisdiction.

But it means that there is a lack of transparency in providing information about how age checks for Discord will work. While Privately is the provider mentioned in the k-ID privacy policy as providing on-device FAE, k-ID’s list of subprocessors also includes Veratad (for “age checks based on ID documents and server-based facial age estimation”).

In a blog post following its age assurance reversal earlier this year, Discord promised “Full transparency on vendors. We will document every verification vendor we work with on our website, including their data handling practices. You shouldn’t have to guess who’s handling your information.”

Now, Incode has been added to the mix as an “experiment,” per Discord’s announcement. The experiment “may not be available to all users.” There is no indication of how or when Discord will advise a user which FAE method is being deployed in any given scenario.

Again, that may depend on regional rules. The implication is not that anything sinister is afoot. Rather, it is a clear illustration of how accountability gets layered through orchestrated age assurance, leaving users to follow a breadcrumb trail to find out who is actually feeding their biometrics into an algorithm. It is not enough to insist that “all third party vendors” are responsible data handlers. The identity industry increasingly demands measurable assurance, and that knowledge demands full, clear disclosure of which firms are performing the service for any given transaction.  

Most industry experts agree that the technical challenges of age assurance have largely been solved, at least by top providers. We know it is possible with the technology that is available. Regulatory challenges remain a going concern, as the legal landscape folds and buckles. But the largest challenge facing the age assurance industry may be communications. The perception that age assurance vendors are nefariously collecting user data to sell off at a profit is fueled in part by an inability of providers to adequately explain to users what they actually do. Erasing that paranoia will require work from providers to ensure their privacy policies clearly reflect actions made in good faith, and do not come off as tortuous or evasive.

Article Topics

age verification  |  biometric age estimation  |  biometrics  |  data privacy  |  Discord  |  facial age estimation (FAE)  |  Incode  |  k-ID