Not immediately deleting the selfie is a pretty fundamental and egregious mistake to make. People are particularly sensitive to selfies not being handled correctly after Discord lost thousands of them, despite promising to delete them after age verification occurred (and then not doing so) https://www.bbc.com/news/articles/c8jmzd972leo

The damage is limited because the selfie is only retained on device, but it still does not signal competency from the EU to fail at the most basic hurdle of disposing of the selfie once verification is complete.

▲

jimmydorry 2 days ago | parent | next [-]

>Discord lost thousands of them, despite promising to delete them after age verification occurred (and then not doing so)

This is misleading, yet everyone seems to repeat it. Discord's implementation of ID verification did not retain IDs. Reporting on this was so poor, but what appears to have happened was that people that failed age estimation / ID checks had to raise a support ticket and get manually reviewed. That support platform was pwned and the active support tickets were leaked. Who knows how long these support tickets were set to live for, but up to 70,000 active tickets getting leaked feels like a drop in the bucket. It's also not immediately clear to me what the alternative is (other than not getting hacked), when you require human intervention to review problematic IDs. Even if the ID only lived on their server for 24 hours during manual review, across a userbase of >200 million users, that's a lot of IDs at risk at any given moment, especially during these initial roll outs of age verification.

▲

deminature 2 days ago | parent [-]

This is a distinction without a difference. Users were assured their selfies would not be retained and they were. Discord then proceeded to lose those selfies to bad actors, after promising not to retain them. The incident has caused enormous distrust of all age verification systems, which were already starting in the mind of the community from a base level of skepticism. It's already highly invasive to take a photo of yourself, but then the user must trust that the organization on the other end will handle it appropriately. To have that trust so conspicuously broken poisons the well for all other age verification systems and websites that are legally compelled to use it, or face penalties from aggressive organizations like OFCOM.

	▲	jimmydorry 2 days ago \| parent \| next [-]
		I disagree! There very much is a distinction and every age verification process will have the same failure mode. If there is something wrong with your account or ID, the user will have to go via the manual support proccess, which necessitates sharing particulars with falliable humans and the fragile support process. The alternative is to offer no support and prevent them from using the service... which is by far the worst outcome.
	▲	stavros 2 days ago \| parent \| prev [-]
		Were users assured that the selfies they emailed to support would not be retained? I'm loath to defend the multimillion dollar corporation, but let's at least be fair.

▲

GoblinSlayer 2 days ago | parent | prev [-]

Welp, this ship has sailed, corporations and governments have data hoarding addiction. They might not yet ask where your grandpa lived 57 years ago, but they seriously ponder this idea how to extort it from you of where else to get this data.