Discord publishes AI summaries of public server chats from 16 November. Members cannot opt out.

A common setup: a software company runs a Discord server for its customers, with 4,000 members, a listing in Discord's public server directory, and a #help channel where customers paste error logs with their account emails in them. On 16 November 2026, Discord gives that server a public web page with AI-written summaries of its public channels. The members have no setting to keep their words out of those summaries, so the only filter is the channel list the company's admins choose under Server Settings, Community, Web Presence. If nobody opens that screen, #help is in.

From mid-December, the messages themselves can appear in Google, in the words of the people who wrote them, for every member whose own setting is on. Discord's announcement says that setting starts on in most countries and off in the EU, the UK and four other countries, "given legal restrictions". In the EU and the UK, the restriction that fits is GDPR Article 25(2): by default, personal data must not be made accessible to an indefinite number of people without the person's own intervention 1. The UK GDPR has the same sentence 2, and Ireland's regulator fined Instagram and TikTok for breaking it with children's accounts that were public unless the child changed a setting.

What is Discord changing, and when?

Discord is putting content from its largest open servers on the web in two steps. Discord calls these servers Discoverable Servers: at least 1,000 members, at least eight weeks old, meeting Discord's activity and safety requirements, and listed in the directory by their admins. There are more than 63,000 of them. Private servers, direct messages and group messages are not affected.

Delisting means turning off Discoverable, which takes the server out of the directory. Usernames and avatars are not shown next to messages or in summaries. Only messages sent after the feature starts can appear, and teens' messages never do.

What can admins and members control?

Admins choose channels in two separate lists under Web Presence, one for summaries and one for messages, and can change them at any time. Turning a channel or a feature off stops new content, but anything already published stays up until it is removed (Discord's help page for admins).

Summaries are the admins' call alone. Discord writes them with AI from recent discussions and says they "may not always be accurate". Its announcement says the members' own setting covers messages, while summaries "will still appear on Server Web Pages unless admins choose to turn them off". A member cannot keep their words out of a summary except by not posting in that channel.

Members control messages with one account-wide switch, "Show my message content from Discoverable channels on web pages" (Discord's help page for members). The setting at the moment a message is sent decides whether it can appear, so switching off later does not cover messages already sent. Deleting a message removes it from Discord's pages, though search engines may keep cached copies for a while. Channels that take part carry a label, and a pop-up tells members before they post.

Leaving out the username does not make a #help message anonymous: it can contain an email address, and a reader can click through from the web page to the conversation on Discord.

Why are EU and UK members opted out by default?

Discord gives "legal restrictions" as the reason, and in the EU and the UK the restriction that fits is GDPR Article 25(2). It says: "by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons" 1. The sentence binds the company that decides how the data is processed, and it has no age limit. The European Data Protection Board (EDPB), where the EU's data protection regulators agree on how to read the GDPR, says it is "particularly relevant in the context of the Internet and search engines", and that people should get "an opportunity to intervene before personal data is made available on the open Internet" 3.

My reading for a feature like Discord's: when people wrote something for one audience, such as the members of a server, and a new feature moves it to the open web, a default they never touched is the case Article 25(2) describes. Someone who posts on a site that is plainly public has already chosen that audience, so the rule does not make every public forum unlawful. Elsewhere Discord relies on channel labels and a pop-up before posting, which could count as the person's intervention; in the EU and the UK it does not rely on them, and no regulator has ruled on a case like this for adults.

Has a regulator fined a company for a public-by-default setting?

Yes. Ireland's Data Protection Commission (DPC) fined Instagram and TikTok for it, both times over children's accounts.

• Instagram, 405 million euros in total (2 September 2022) 4. Child users' accounts were public by default, so anyone could see their posts unless the child changed the setting after signing up, and the DPC found a breach of Article 25(2) 5.
• TikTok, 345 million euros in total (1 September 2023), with a breach of Article 25(2) among others 6. TikTok had shown new child users a full-screen pop-up with "Go Private" and "Skip" buttons, explaining that otherwise "your videos can be viewed by anyone". Going private was something users had to choose, and a user who skipped stayed public 7.

The TikTok case answers a design question for any product: a clear notice with a one-tap way out did not count as the user's intervention, because doing nothing still left the account public.

What should a company with a Discord server or a publishing feature do?

If your company runs a Discoverable server, or your product puts anything users write on the open web, here is what you can do. If you do nothing, AI summaries of every public channel, #help included, go on a public page under your server's name on 16 November, and from mid-December customers' messages there can turn up in Google for every member whose setting is on.

If your company runs a Discoverable server

• Treat the summaries as your own publication. Your members cannot keep their words out of them and your admins choose the channels. Whether that makes you share responsibility with Discord has not been tested, so I would act as if it does.
• Open Web Presence before 16 November (Server Settings, Community, Web Presence) and deselect support, billing and introduction channels from both lists. Check again after the date: published summaries stay up until removed.
• Tell members which channels go on the web, where their own switch is (User Settings, Data & Privacy), and that a message sent while it is on stays eligible until they delete it.

If your product publishes what users write

A community forum, a public feedback board and public share pages all face the question Discord answered by region: which way the default points.

• Start the setting at off for each user in the EU, EEA and UK, and let the user's own action switch it on. That is what Discord did, and what I read Article 25(2) to ask. Off in every country is simpler still: one default to build and to explain.
• Do not count a one-time notice as the switch. TikTok's pop-up explained the choice, and the public default was still a breach.
• Say what switching off does to earlier posts, as Discord's help pages do, and show existing users the new setting before it takes effect, the same point I made about AI training settings.
• Update the privacy policy to say who can see the content (anyone on the web, including search engines) and how to remove it. A pull request that adds public pages for user content is one of the changes that put a privacy policy out of date; Lawcel, a tool that reads a company's pull requests and flags the ones that affect its legal documents, would flag it for review.