A Discord breach leaked 68,000 Australian IDs weeks before the age-verification law hit

The internet box that asks for your passport

Sarah McLaughlin, a senior scholar of global expression at FIRE (the Foundation for Individual Rights and Expression), starts with a mundane scene: you post about a sports match, a box pops up asking you to prove your age, and you upload a photo of your passport hoping it doesn't come back to haunt you. Her thesis is one line: age verification is identity verification. Once the law requires you to prove who you are before you can speak, anonymous participation online stops being the default.

The wave is real and global. Australia's under-16 social-media ban took effect in December 2025, and the UK's Online Safety Act is already live, with an under-16 ban proposed. McLaughlin lists France, Spain, Greece, Denmark, Norway, the UAE, Indonesia and Malaysia moving the same direction. In the US she counts at least 19 states restricting social media for minors, over 20 states with adult-content age-verification laws, and the Free Speech Coalition v. Paxton Supreme Court decision (2025) that upheld one of them. On top of that sit KOSA, folded into a House package, and app-store age-assurance laws being litigated in Texas and Utah.

The receipts are the strongest part of the essay. Weeks before Australia's ban, a Discord breach "hit 68,000 Australians," exposing government ID images, names, usernames and emails. Australia's own Age Assurance Technology Trial found verification providers were "over-anticipating eventual needs of regulators," producing "unnecessary and disproportionate collection and retention." That data is supposed to be destroyed once "all purposes have been met," except the purposes include "challenges and complaints," so the retention clock never quite stops. Snapchat routes verification through k-ID, a Singapore-based vendor, which raises the question of which government can later demand that pile. And the ban's payoff? Australia's research found roughly seven in ten kids still using social media months later.

The privacy harms McLaughlin enumerates: data breaches, over-broad collection and retention, censorial legal demands for the collected data, pressure to self-censor when your real name is tied to a post about addiction or an embarrassing medical issue, and what she calls blatant First Amendment problems. Her close is the part that worries her most: once this identity-verification infrastructure is built into law, "we may find it very difficult to tear down."

The cryptographer who says the privacy loss is optional

The thread's most concrete pushback came from someone who works on the math for a living.

"There are at least some technological solutions here, such as anonymous credentials… the verifier can't even correlate repeated requests across users." — Jeremy Kun, who works on fully homomorphic encryption at Google

His point: a government serious about both age checks and privacy could issue digital-ID-backed credentials so a site learns only "over 18," never your name, never a trackable handle. A separate commenter sketched the same DMV-keypair design in plain terms, where apps ask is_over_21 or is_citizen and get a yes or no, nothing else. The unspoken catch sits inside Kun's own parenthetical: "doubtful they truly are."

"Identifying yourself on the internet is long overdue"

Not everyone in the thread mourned the change. The sharpest dissent came from a builder in the space.

"How is it any different from being required to identify yourself to get a phone or electricity account? Identifying yourself on the internet is long overdue." — dools, who runs the BenkoPhone business-number app

A second voice wanted the burden placed only on posting, not reading: anonymity for consumption, real names for speech, so "the common man at least has a chance to evaluate your statements." Against that, a skeptic asked privacy advocates to do better homework:

"For this argument to carry weight with voters, privacy advocates need to be much more specific about what 'coming back to haunt you' looks like." — a reader who quoted FIRE's own breach-and-retention list back at it

The slippery-slope map, and a darker parallel

Where the essay warns generally, the thread drew the staircase. One UK reader laid out the next few years as numbered steps: age gating and a VPN ban "to protect children," then an ID passport sold as convenience, then ISPs, renting and work all requiring it.

"6. Well done, you built the torment nexus!" — a UK reader writing from inside the country already running the Online Safety Act

Another voice reached for history, troubled less by the law than by the shrug around it, the "it's for the children, so whatever it takes" reflex he reads as manufactured consent:

"We always have hard time to understand how people could have let Nazi, Stasi, or Stalin come in power… it never came in one day." — a long-tenured commenter invoking Putin's gradual rollback in Russia

And one reader landed the pun the essay's title set up. The headline says "decimate"; a commenter noted 90% of people don't know it literally means a 10% cut. The dry rejoinder, four words long: "Is a 10% reduction that bad?" The thread's own answer, from the people who do this for a living, is that the cut won't stop at ten. And unlike Discord's leaked 68,000 records, an identity layer baked into law doesn't get patched out.