cloudflareApr 1, 2026

Our ongoing commitment to privacy for the 1.1.1.1 public DNS resolver (opens in new tab)

Cloudflare reports that an independent Big Four accounting firm has confirmed its 1.1.1.1 public DNS resolver continues to meet its privacy commitments. The review was conducted because Cloudflare’s DNS infrastructure has expanded and become more complex since the previous examination in 2020. Cloudflare says it aims to make privacy the default and encourages other public DNS providers to undergo similar independent reviews. ## Renewed Independent Privacy Examination - Cloudflare launched 1.1.1.1 in 2018 as a fast, privacy-focused DNS resolver. - A first independent review took place in 2020. - After major changes to its technology stack and DNS platform, Cloudflare commissioned the same accounting firm to conduct another examination. - The latest review examined evidence collected after the 2024 calendar year and took several months to complete. - The resulting report is available through Cloudflare’s compliance resources. ## Confirmed Privacy Commitments The examination confirmed that: - Cloudflare does not sell or share public resolver users’ personal data with third parties. - Resolver data is not used to target users with advertisements. - Cloudflare retains or uses the requested DNS information, rather than information identifying the person making the request. - Source IP addresses are anonymized and deleted within 25 hours. - DNS query information is not combined with other Cloudflare or third-party data in a way that could identify individual users. ## Limited Network Troubleshooting Data - Cloudflare may use randomly sampled network packets for troubleshooting and attack mitigation. - These samples represent no more than 0.05% of total traffic. - The samples can include the querying IP address, but are used solely for operational security and network reliability purposes. ## Scope of the Latest Review - Unlike the broader 2020 examination, the latest review focused exclusively on privacy commitments. - The earlier review also covered how Cloudflare handled anonymized transaction and debug logs, known as “Public Resolver Logs.” - Cloudflare says the use of those logs has evolved, including supporting services such as Cloudflare Radar. - The company maintains that these changes do not affect personal information or user privacy. Cloudflare’s practical position is that 1.1.1.1 users should not have to trust privacy promises alone: independent examinations should verify them. It recommends reviewing the published accountant’s report and continues to present 1.1.1.1 as a privacy-first DNS option.

privacycloudflarenetwork-securitydns+1

discordFeb 24, 2026

Getting Global Age Assurance Right: What We Got Wrong and What's Changing (opens in new tab)

Discord’s CTO says the company mishandled communication around its global age-assurance rollout, leading users to believe that face scans or ID uploads would be required for everyone. Discord’s stated goal is to protect teens and restrict age-sensitive content while preserving the normal experience for most users and avoiding collection of users’ identities. The company plans to use internal signals for most age determinations and privacy-focused third-party verification only when necessary. ## Where Discord Says It Fell Short - Discord did not clearly explain how age assurance would work or who would be affected. - Many users mistakenly believed that everyone would need to submit a face scan or government ID. - The company acknowledges that skepticism about technology companies collecting personal data is justified. - Discord says the rollout was not intended to create a pretext for gathering more personal information. ## The Goal of Age-Appropriate Experiences - More than 90% of users are expected to continue using Discord without verifying their age. - Discord wants teenagers to receive stronger safeguards while allowing adults to access the full range of content. - The approach is being influenced by laws already taking effect in the UK and Australia, with Brazil, Europe, and several US states following. - Discord says building its own system could demonstrate that age can be verified without identifying users. ## Internal Age Determination - Discord’s systems may determine age using account-level signals, including: - Account age - Whether a payment method is attached - Server membership patterns - General account activity - The system will not read private messages, analyze conversations, or inspect posted content. - Discord compares this process to existing safety systems used to detect spam, raids, and coordinated abuse. - The company plans to publish its methodology before the global launch. ## What Happens If Verification Is Required - Fewer than 10% of users are expected to need additional verification. - Users who do not verify can keep: - Their accounts - Servers - Friends lists - Direct messages - Voice chat access - They will only lose access to age-restricted content and the ability to change certain default safety settings intended to protect teens. - A user’s age group will remain private and will not be visible to other Discord users. ## Third-Party Verification Partners - Discord plans to use vendors when its internal systems cannot confirm that a user is an adult. - Vendors are intended to return only an age group, not the user’s identity. - Discord says vendors cannot connect verification information back to a Discord account, and Discord cannot use the process to learn the user’s identity. - Partners undergo security and privacy reviews, contractual data-use restrictions, and retention and deletion requirements. - Verification data is generally deleted immediately after it is no longer needed. - Discord clarified that the vendor involved in a previous customer-service security incident is not used for age assurance and is no longer a partner. - The company tested Persona in the UK in January but decided not to proceed with that vendor. Discord’s revised approach emphasizes minimal data collection, multiple verification choices, and transparency about how age estimation works. Publishing the methodology and clearly explaining vendor safeguards will be essential to rebuilding user trust.

privacymachine-learningidentity-verificationdata-protection+3