The comments so far assume that Discord / Twitch / Snapchat don't care as entities that people will start bypassing their age verification systems. I believe the rank-and-file think that's the case. I think even the engineers and PMs think that's the case. But that's not the game.

There are many ways in which such a system could be implemented. They could have asked people to use a credit card. Adult entertainment services have been using this as a way to do tacit age verification for a very long time now. Or, they could have made a new zero-knowledge proof system. Or, ideally, they could have told the authorities to get bent.

Tech is hardly the first industry to face significant (justifiable or unjustifiable) government backlash. I am hesitant to use them as examples as they're a net harm, whereas this is about preventing a societal net harm, but the fossil fuel and tobacco industries fought their governments for decades and straight up changed the political system to suit them.

FAANG are richer than they ever were. Even Discord can raise more and deploy more capital than most of the tobacco industry at the time. It's also a righteous cause. A cause most people can get behind (see: privacy as a selling point for Apple and the backlash to Ring). But they're not fighting this. They're leaning into it.

Let's take a look at what they're asking from people for a second, the face scan,

    If you choose Facial Age Estimation, you’ll be prompted to record a short video selfie of your face. The Facial Age Estimation technology runs entirely on your device in real time when you are performing the verification. That means that facial scans never leave your device, and Discord and vendors never receive it. We only get your age group.

Their specific ask is to try and get depth data by moving the phone back and forth. This is not just "take a selfie" – they're getting the user to move the device laterally to extract facial structure. The "face scan" (how is that defined??) never leaves the device, but that doesn't mean the biometric data isn't extracted and sent to their third-party supplier, k-Id. From the article,

    k-id, the age verification provider discord uses doesn't store or send your face to the server. instead, it sends a bunch of metadata about your face and general process details.

The author assumes that "this [approach] is good for your privacy." It's not. If you give me the depth data for a face, you've given me the fingerprint for that face. A machine doesn't need pictures; "a bunch of metadata" will do just fine.

Discord is also doing profiling along vectors (presumably behavioral and demographic features) which the author describes as,

    after some trial and error, we narrowed the checked part to the prediction arrays, which are outputs, primaryOutputs and raws.

    turns out, both outputs and primaryOutputs are generated from raws. basically, the raw numbers are mapped to age outputs, and then the outliers get removed with z-score (once for primaryOutputs and twice for outputs).

Discord plugs into games and allows people to share what they're doing with their friends. For example, Discord can automatically share which song a user is listening on Spotify with their friends (who can join in), the game they're playing, whether they're streaming on Twitch etc. In general, Discord seems to have fairly reliable data about the other applications the user is running. Discord also has data about your voice (which they say they may store) and now your face.

Is some or all of this data being turned into features that are being fed to this third-party k-ID? https://www.k-id.com/

https://www.forbes.com/sites/mattgardner1/2024/06/25/k-id-cl...

https://www.techinasia.com/a16z-lightspeed-bet-singapore-par...

k-ID is (at first glance) extracting fairly similar data from Snapchat, Twitch etc. With ID documents added into the mix, this certainly seems like a very interesting global profiling dataset backstopped with government documentation as ground truth. :)