Forced Identification

❗Article Status Notice: This Article is a stub

---

This article is underdeveloped, and needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Learn more ▼

Issues may include:

• This article needs to be expanded to provide meaningful information
• This article requires additional verifiable evidence to demonstrate systemic impact
• More documentation is needed to establish how this reflects broader consumer protection concerns
• The connection between individual incidents and company-wide practices needs to be better established
• The article is simply too short, and lacks sufficient content

How you can help:

• Add documented examples with verifiable sources
• Provide evidence of similar incidents affecting other consumers
• Include relevant company policies or communications that demonstrate systemic practices
• Link to credible reporting that covers these issues
• Flesh out the article with relevant information

This notice will be removed once the article is sufficiently developed. Once you believe the article is ready to have its notice removed, please visit the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel, or mention its status on the article's talk page.

Forced Identification is the practice of forcing the user to unnecessarily provide their ID in order to access a product or service. The primary concern for forced identification comes from how services neglect to adequately secure this sensitive information for its user base, leading to dangerous security breaches occurring.

Unlike with traditional consumer protection incidents, Forced Identification is typically caused by governmental laws, such as the UK Online Safety Act, rather than any sort of intentional data collection completed by other companies.

How it works

Forced Identification's functionality varies based on the region it is enforced within and how it is integrated by the company that uses it. Regardless, the result traditionally leads to sensitive information that is stored on servers that may be breached at any moment.

The traditional usage of forced identification is for age verification, however there have been other uses as well, such as spam prevention.

Why it is a problem

Risk of lost or stolen data

“Any system can be hacked—this is no longer a secret.” ― Dan Kaminsky, Security Researcher and DNS Expert

There is no such thing as a system that is unable to be breached, and IDs are a valuable product that malicious actors are incentivized to hijack. These 2 facts tend to lead to an increase in attempted security breaches. As an example, in late September 2025, attackers breached Discord's 3rd-party customer service portal, leading to an estimated 70,000 photo IDs for the United Kingdom being stolen from the platform.

Loss of privacy

Some legal agreements with platforms will allow them to sell user data to 3rd parties, and this may include any legal identification that is given to these companies when signing up. This data can also be given to governments for the purpose of tracking users.

Censorship

Users who are forced to give their ID when using a platform may be forced to see feeds only curated for their region, as well as have their content specifically moderated more harshly depending on the region's government. This also can lead to methods where VPNs are used to access content that may otherwise be inaccessible in some regions to no-longer be viable.

Examples

Legal acts

• The United Kingdom Online Safety Act (OSA)
• US Kids Online Safety Act (KOSA)

Platforms with forced identification

• Discord: United Kingdom
• Google: United Kingdom, United States

Incidents involving forced identification

• Discord: Customer service portal had a breach that led to an estimated 70,000 UK IDs stolen.
• Tea Dating Advice: A 4chan post leaked over 72,000 sensitive images, including those with US state IDs.