I don’t know if you use Discord (I use it sometimes when playing Dungeons & Dragons online with friends) but it is a free app for text, voice, and video communications. It has more than 150 million monthly active users some half a billion registered accounts. If you’ve got teenage children, ask them for a demo.
Discord recently stated that an “unauthorised party” had compromised one of Discord’s third-party customer service providers and obtained usernames, email addresses, billing information, IP addresses and customer support messages. Another day, another data breach. Indeed, but it caught my eye because Discord also said that the attacker also gained access to a number of government ID images (eg driving licences, passports). Now, you might wonder why they would be storing this kind of personally-identifiable information in a honeypot ideally architected for criminals of all kinds. Well, it is because they use age estimation technologies to determine whether users are over 18 or not. If a user is determined to be under 18 and barred from certain parts of the service, the user can appeal – and this involves sending copies of passports and other documents off to web sites from where they will almost invariably be hacked.
This is ridiculous way to operate an online economy.
The way that things should work is that when you create an account and need to show that you are over 18, or a US citizen or a member of the Manchester City supporters’ club, then you should be required to present a verifiable credential that attests to whatever specific attribute is needed. It is none of Discord’s business what your name, address, date of birth, nationality, driving status or anything else: all they need to know is whether you are over 18 or not.