Regular Discord users don't need to send in anything. It's used to verify your bot (only applicable for bots that are in more than 75 servers), which seems like a reasonable use case.
[2] https://stripe.com/docs/acceptable-verification-documents
Kind of like IRC? Which is basically what Discord is. Why would you assume anything you put on the internet isn't part of the permanent public record? (Wait until you find out about mailing lists, Reddit mirrors, the Internet Archive, ...)
(Aside: The only halfway sane solution to this is having separate disconnected identities for each service you use and cycling them semi-regularly so you don't need to worry too much about small identifying details being aggregated.)
One, Discord is still primarily used by underage people.
Two, most Discord guilds are not public, this was a case of malicious bots. If you install an app on your phone, is your expectation automatically that it will skirt all App Store rules and dump the contents of your phone on the internet? I hate people that obsessively archive everything, but even I can see the case for IRC being expected to be public. Especially without SSL enforcement on a channel. Discord does not work like that at all. You are advocating for a treasure trove for the likes of Kiwifarms. (Which is exactly how dis.cool ended up being used, as a stalking tool)
Three, the people who say “every litte piece of info on the internet becomes part of the public record, be careful” are also the ones doing the archiving. Nobody else cares enough. Stop doing it. Not everything is worth preserving only because you are a data hoarder. I’m happy you think you’re building the library of alexandria, just make sure it’s not built out of piles of shit and PII.
If it was technically feasible to permanently record every public place outside the internet and make the recordings available to everyone, would you be in favor of that too? Just because the internet makes that technically feasible doesn't mean it's a good idea.
Many of them, perhaps. Certainly not all of them. That's irrelevant because there are a great many more who aren't necessarily saying much of anything but are logging everything. There are clear business and governmental (ie surveillance) use cases for such data so it's more or less guaranteed to happen en masse.
> most Discord guilds are not public, this was a case of malicious bots
Apologies, I don't actually use Discord and (based on this and a few other comments here) have realized that the term "bot" is being used in a very nonstandard manner. It seems that Discord "bots" are server side apps that can be launched (ie used) by other people. Using such bots to scrape private channels that the author doesn't otherwise have access to is indeed highly malicious and not to be expected or tolerated. (Of course one could wonder why such bots were permitted unrestricted communication with the outside world in the first place. Does Discord lack even a basic permission system?!)
Still, if you choose to run unverified code provided by an unknown party you should fully expect to be exploited to the maximum extent possible. It's really no different than installing arbitrary browser extensions or running arbitrary binaries that you found on the internet.
This has some other unfortunate side effects (user tokens can't be used for bots, third party clients are a risk), but unfortunately the only way to really curtail this behavior. Privacy is not something easily understood, especially for people outside tech that just want to be around their friends during the pandemic, do not be blind for this. Technology can't be the sole component of solving this issue, so I'm glad Discord is committed to legally perusing those that misuse their API.
> (user tokens can't be used for bots, third party clients are a risk)
... how convenient. So sorry, but we need to restrict what you can do for your own protection. Where have I heard that one before?
> Privacy is not something easily understood
"Privacy" isn't what needs to be understood here. "Don't run arbitrary code" is what applies; it applies everywhere whether you like it or not.
For some additional context, Discord bots aren't that far off from IRC bots.
You invite a bot to your server, you give the permissions and channel access you want it to have, and it receives various events over the web gateway such as "Message Received" of which the bot developer can use to build elaborate command systems and various other features.
Prior to the must-be-verified limit of 100 guilds, Discord had a serious issue with scam bots that would mass-message users promising free bitcoin or "insert free thing here", and usually one the "steps" was adding the bot to an additional guild. This resulted in the bot quickly cascading past 100 guilds within a matter of hours before Discord support had even noticed the problem.
Once joined to the additional guild, it would scrape as much of the server content as it could and usually dump it on some sort of "discord user tracker" platform.
On top of preventing joins past 100 guilds, verification is also required for some sensitive capabilities such as querying the entire member list.