Minors on Your Server: Age Safety and Your Responsibility

A moderator forwards you a screenshot at half past eleven on a Tuesday. Somebody in your general chat has mentioned, in passing and entirely cheerfully, that he has a maths test tomorrow and he is in Year 8. Your rules channel says 16+. Your Discord join gate has a birth-year dropdown he clicked through in about a second. And you are now sitting there realising you have no idea what you are supposed to do with this, whether it matters, or who you would even tell.

This is orientation, not legal advice — obligations genuinely differ by country, and section 8 says more about that. What follows is the part that does not depend on where you are: the platform rules that already apply to you, the measures that reduce risk, and the sequence to follow when something serious lands.

1. Your server is younger than your rules say

Minecraft is rated PEGI 7 in Europe and ESRB E10+ in the US. It is marketed to, sold to, and played by children, and running a server for it means running something children will join. That is not a failure of your moderation; it is the audience of the game.

Nobody can give you a reliable percentage, including anybody who quotes one at you, because every figure of that kind is built on self-reported ages from people with an obvious reason to lie. So do not plan around a number. Plan around what you can observe directly on a busy evening: voices in a voice channel, references to school terms and homework, the specific rhythm of a player base that empties out at nine on a school night. If you run a Minecraft server of any size, the correct working assumption is that minors are present right now, because assuming otherwise is a claim you have no way to verify.

2. Rules that already apply to you, whatever your local law says

Two sets of published rules bind you today, independently of your country.

Discord's terms set the floor at 13, and require that you also meet whatever higher minimum applies in your country — Discord maintains a published list of those and says outright that its services are not designed for or directed at under-13s. Its community guidelines go further and are the ones that matter operationally for a server owner: sexually explicit content must not be reachable by minors, server owners are expected to apply the age-restricted label to channels containing adult sexual content, and Discord states that it reports child sexual abuse material and grooming to the National Center for Missing & Exploited Children, which can involve law enforcement. There is also a rule most owners have never read: Discord removes spaces that encourage or facilitate dating between teenagers. If your community has a channel of that shape, it is not a grey area.

Discord has also been moving age determination to the platform itself, under what it calls teen-by-default: an inference model decides most accounts in the background, facial age estimation or ID verification confirms the ones it cannot, and any account not confirmed as adult gets teen defaults it cannot switch off — including no access to age-restricted channels. That rollout has already slipped once and is staged differently in countries with their own verification laws, so treat it as direction of travel and check Discord's own pages before relying on it. The broader changes to how Discord treats community servers tell the same story: more of this is decided above your head each year, and less of it is yours to configure.

Mojang's commercial usage guidelines are blunter than most Minecraft owners realise. Servers, the things you sell on them, and the advertising for them must all be suitable for children and minors — no gambling, no pornography — and you must state clearly that you are not Mojang or Microsoft and not associated with them. There is no version of a commercial Minecraft server that is an adults-only space. If your Minecraft community has an adult register, the guidelines have already answered the question for you.

3. The age gate stops nobody, and you should still have one

A birth-year dropdown is one click. Children click it. Nobody in the history of community servers has been stopped by one, and any owner who tells you their gate keeps the server 16+ is describing a wish.

So be clear about what it is for. It is a record that you asked, and a dated note of what you were told. That moves you from "we never checked" to "he told us he was seventeen", which is a materially different position, and it gives you something concrete to compare against when a story later changes.

Put the question in the application rather than in a pop-up. If you already run a whitelist — and an application people actually complete is the cheapest filter available to a small server — one age question stored with the application costs you nothing and is far more useful than a gate on the Discord invite, because it sits alongside a name, a date and a decision.

What not to do: never ask for a photo, never ask for identity documents, and never collect a full date of birth you have no use for. You are not building an age-verification system. You are keeping one answer to one question.

4. The risk is in voice and DMs, not in public chat

Public text chat is the surface everyone worries about and the least dangerous one you have: logged, visible, already moderated, and the last place anybody would choose to do harm.

Voice channels are the opposite. Discord does not record voice, there is no audit log entry containing what was said, and a report about something that happened in voice will normally arrive with no artefact at all. That is where the actual relationship-building happens, and it is where a small number of adults deliberately go.

Direct messages are worse still, because they are outside your server entirely. Two of your members who share a server can message each other, and you cannot see it, moderate it, or log it. Banning one of them removes their access to your server and does nothing whatsoever to the existing DM channel between them; the conversation carries on without you. The setting that controls this — allow direct messages from server members — belongs to each user, per server, not to you. You can tell people it exists. You cannot switch it on for them.

Given that, the useful measures are structural rather than technical:

• No private voice channels for small groups. Keep voice channels public and joinable, so a moderator entering is normal rather than an intervention.
• Staff never contact a player privately. All staff-to-player contact happens in a ticket, a thread, or a channel where another moderator can read it. This is the single highest-value rule in this article, it costs nothing, and it protects your staff from accusations as much as it protects players.
• Nobody gets moved into a private channel by a moderator, for any reason, including a well-meant one.
• Adults who spend all their time talking to the youngest players are a pattern, not a coincidence, and it is a pattern your moderators should be told to notice and mention. The everyday work of moderating a community is mostly noticing patterns like this early.

5. Separate the adult register properly, or drop it

Plenty of communities have adults who swear, drink on stream and post jokes that are not for eleven-year-olds. That is fine, and it needs an actual boundary rather than a social one.

The failure mode to name: an 18+ role handed out by a moderator when somebody asks for it is not a gate. It is a list of people who asked. Discord's age-restricted channel setting is enforced by the platform's own age determination, which is stronger than anything you can build and is not your moderator's judgement call at two in the morning. If the whole community is adult in character, mark the server itself age-restricted and accept the consequence, which is that unconfirmed accounts cannot get in.

Then write the register into the rules, because "keep it clean in general chat" is not enforceable and a rule an admin can actually apply is. And if you are running Minecraft commercially, section 2 has already decided this for you: keep the whole thing at the lower register and stop pretending there is a grown-up wing.

6. On a credible safeguarding report: preserve, remove, escalate

Something will eventually be reported to you that is not a griefing complaint. The instinct is to investigate — gather the facts, ask the child what happened, confront the adult, work out whether it is real before bothering anyone. Do not. You are not equipped to do it, your questions will contaminate the account, and the evidence-gathering people improvise under pressure routinely destroys the evidence.

You are not the investigator. Your job is to make the evidence survive and put it in front of somebody who is.

The order matters:

1. Preserve first, before you touch anything. Copy the message links — Discord's Trust & Safety team needs the link to investigate, and a message that has simply been deleted no longer has one. Screenshot with timestamps and usernames visible. If the content has to come down immediately, use Discord's Delete and Report action rather than a plain delete, so the report is filed with the content attached.
2. Remove access. Ban, remove roles, pull them off the whitelist. This is containment, not a punishment decision, and it does not need your appeals process attached to it yet.
3. Escalate to the platform. Report it to Discord with the links you preserved. If a child appears to be in immediate danger, that is the police in your country — not a Discord report, and not you.
4. Say almost nothing. Tell the person who reported it that it has been actioned and reported. Do not brief the wider staff team beyond who needs to know, do not name anyone in an announcements channel, and do not post a statement.

Two specific things never to do: do not confront the person, because that reliably ends with everything being deleted. And never download or archive suspected material yourself in order to "keep evidence" — report the links, and let the platform hold the content.

7. Store less about children, deliberately

Data minimisation is not paperwork. It is the measure that shrinks the size of your worst day, and it is largely free.

Notice how much you already store without ever deciding to. A vanilla Minecraft server writes the player's IP address into logs/latest.log on every single join, keeps addresses in banned-ips.json, and keeps names and UUIDs in usercache.json. A FiveM server logs license:, steam:, discord: and ip: identifiers on connect, and txAdmin keeps a player database of them. A ticket bot writes a full transcript of every support conversation and sends copies to people. If you run a voice-recording bot, you are storing recordings of children's voices, which is a decision you should make consciously or not at all.

So set retention windows and actually enforce them. Rotate server logs rather than keeping four years of them. Purge your grief-logging database on a schedule — /co purge t:60d if you use CoreProtect. Delete ticket transcripts after a fixed period. Delete whitelist applications once the application has been decided, keeping only the decision. And for every field on that application, ask what you would say if you had to explain out loud why you were still holding it. Real name, school, town, photograph: there is no answer to that question that ends well.

The security argument points the same way. A compromised moderator account with access to a database of children's names, addresses and Discord IDs is a categorically worse incident than a compromised account with nothing behind it.

8. What this does not cover

Legal obligations vary by country, by whether you monetise, and increasingly by the size of your community, and getting a threshold wrong in print is worse than not stating one. If you take money, if your community is large, or if you operate somewhere with a specific online-safety regime, that is a conversation with somebody qualified in your jurisdiction rather than a blog post.

But none of the seven sections above require you to know any of that. They are platform rules you already agreed to, plus a handful of structural decisions that cost nothing. If you do exactly one thing after reading this, make it the rule in section 4: staff do not talk to players privately, ever. It removes the channel where nearly all of this actually happens, it needs no policy document, and it takes an afternoon.

One last practical thing: say plainly what the community is and who it is for. Register and expectations are part of what separates a listing a reader trusts from a generic one, and a directory entry that states them attracts fewer of the people it was never for.