Back web.archive.org

Doublecounter Is Violating Your Privacy

web.archive.org • October 7, 2026

DoubleCounter, a popular Discord bot claiming to protect against alt accounts, has been collecting and exposing user data in ways that violate privacy laws (specifically the GDPR). Despite promising not to or sell data, it links accounts using IPs and browser data, then sells access to these links via tools like Doogle. These features are documented to have revealed private accounts without consent or notice.

If you ever verified through DoubleCounter, your data may have been exposed or monetized without your informed consent. If you are a server owner, please consider removing DoubleCounter from your server: Discord now includes its own built-in alt detection and raid protection features. Stopping very few users by exposing the private data of all other users is not a good trade-off.

You can join a collective GDPR complaint here:

What is DoubleCounter?

DoubleCounter presents itself as a "privacy-respecting" 1 Discord bot designed to prevent users from joining servers with alternate ("alt") accounts. For stopping trolls, spammers, ban evaders, etc. It operates on a massive scale, having "verified" over 40 million 4 users across 500,000 Discord servers 3 . This verification process, just opening a link that collects some data on your browser and IP 6 , helps them generate nearly 400,000$ USD in annual revenue 2 (data from 2022) through ads placed on that verification page and selling premium features 7 .

This "anti-fraud" system systematically seems to operate in direct conflict with user privacy and the most fundamental rights guaranteed under the EU's General Data Protection Regulation ("GDPR"). Because the parent company, Tellter, is based in France 10 , all users are protected by the GDPR (even if they are not EU citizens) 8 .

A quick overview on two of DoubleCounter's features:

Lens : A subscription service showing a user's history across different servers using DoubleCounter - things like bans, kicks, or other moderation actions.

These tools have massive privacy issues, which we'll in detail later. They basically turn the private data that DoubleCounter collect into publicly searchable information, effectively doxing tools.

"All data is automatically processed, encrypted, and never viewed by humans. We do not sell or your data".

It is not accurate based on their actual practices:

Data is shared : User data, specifically the links between your main account and any suspected alts (including Discord IDs and usernames), is routinely shared with server moderators via logs when an alt is detected trying to join. Critically, it's also shared (or rather, made publicly searchable) through the "Doogle" and "Lens" features. The massive issue with these tools will be explained in detail later. There is a documented case of it having sent a direct message to a user revealing the identity (username and ID) of a household member flagged as an alt simply because they shared an IP address. This exposed a private, sensitive account owned by that housemate to someone else in their , which lead to them being labeled a "creep".

Data is sold : "We do not sell [...] your data"? Access to "Doogle" capabilities (beyond three free searches in your lifetime) and the "Lens" feature (which shows a user's moderation history across different servers) requires a paid subscription 7 . Why would charging money for access to user data not be selling user data?

Data is viewed by humans : The claim that data is "never viewed by humans" just fails instantly. Server mods see the usernames and IDs in logs. Paying users see the linked accounts of anyone via Doogle/Lens. And DoubleCounter's own staff clearly access and this data internally, as evidenced by email responses providing specific linked account IDs. All alt links and join attempts are also forwarded to DoubleCounter admins, and routinely shared publicly in their Discord server. 11

A pattern of privacy violations

This is where we dive a bit deeper into why they're violating privacy laws like the GDPR, this should hopefully be easy to understand even if you're not an expert.

Discord IDs are personal data. Linking two together is linking stuff to you .

This argument fails because GDPR does not rely on the narrow concept of "PII". Under GDPR, any information that relates to an identifiable person qualifies as personal data 9 . Connecting something to an online identity is considered personal data, even if you don't know the "real-world" identity of the person behind it. A Discord User ID is personal data because:

It directly identifies a specific account on Discord.

Using Discord’s API 15 or public tools like discord.id , anyone can instantly retrieve the username, profile picture, and public connections tied to that ID.

GDPR explicitly covers pseudonymised data (e.g., IDs) if it can be linked to a person using additional information - even if that information is held by third parties 5 .

DoubleCounter's flawed reasoning hinges on claiming that linking accounts (e.g., associating two Discord IDs) does not tie data to you . This is absurd:

Discord IDs are unique identifiers tied to real accounts.

Linking IDs creates a profile on users. Even without knowing their "real-world" identity, this profile relates to an identifiable person under GDPR.

The links themselves are non-public personal data, as they reveal associations only DoubleCounter has created and stored.

After being presented with evidence, they eventually conceded the point in an email: "You're absolutely correct that Discord User IDs are considered personal data" 16 .

The problematic "legitimate interest" claim

Let's talk "Legitimate Interest". Under GDPR, companies sometimes don't need your explicit consent to use your data if they have a necessary reason (a "legitimate interest") and if using the data doesn't unfairly harm your privacy rights 18 . It's a very fragile argument to make. Legitimate interest is a rather complex topic, companies can't just do anything they want and claim "legitimate interest". DoubleCounter's main argument for keeping the links between your accounts, even after you ask for deletion, is "fraud prevention" 10 .

But here are a few issues with that:

Exposing very personal accounts : As mentioned before, in their support server, I stumbled across the private 18+ account of a person being exposed to their housemate via a DoubleCounter DM. This wasn't even Doogle/Lens, it was the bot oversharing data based on a shared IP. How can any balancing test conclude that the "interest" in potentially stopping one person from joining a server outweighs the actual harm and privacy violation of outing someone's private account to their family?!? Many people use alts for perfectly valid privacy reasons - separating stuff from personal life or keeping sensitive interests separate from their main identity. Which is totally fine. DoubleCounter infringes on this need for privacy.

Internal contradictions : In an email exchange, after we pointed out that the /privacy command wasn't showing the linked accounts DoubleCounter knew it had 16 , the explanation given was that the bot performing the checks doesn't have direct access to that stored link data. If the bot doing the "fraud prevention" doesn't even use or need the stored links you refuse to delete, then how can it be necessary to keep them under legitimate interest? These claims appear very inconsistent.

Not deleting data correctly : GDPR gives you the right to say, "I object to you using my data for this 'legitimate interest' reason in my specific situation" (Article 21). The company then has to prove they have compelling grounds that override your privacy rights for your specific case . They can't just give a generic "muh fraud prevention!" excuse. Their Discord support server is full of users reporting that they want all their data deleted, and DoubleCounter just ignores them. DoubleCounter is required to inform users of this right 21 , which they didn't do.

Doogle & Lens: Your privacy for sale (whether you know it or not)

A difficult process for exercising rights

Beyond these issues, the process of trying to exercise basic privacy rights is unnecessarily difficult.

Incomplete /privacy command : Their policy says to use the /privacy command in a server to get a copy of your data sent to your email 10 . When we tried it, the bot replied, "There is no data your account stored in our database" 16 . But emails with support confirmed they did have data (the linked alt account ID) 16 . So, the official tool for data access appeared broken or intentionally incomplete. Their explanation changed, first claiming it only retrieves IP addresses (which they also said weren't stored for this user), then claiming the bot doesn't even know the user ID. This prevented users from easily seeing what data was held.

Inconvenient access : Why does the /privacy command only work inside servers where the bot was active 10 ? What if the server owner disabled commands? You'd have to join DoubleCounter's specific support server just to access basic privacy settings. This is unnecessary, making it harder for users to control their data (although we got told that this is planned to be fixed after we complained).

Staff confusion and misinformation : Dealing with support is very inconsistent. Users in the Discord server reported being told incorrect things by moderators, like data couldn't be corrected/modified ("this can't be changed"), or generally being discouraged from pursuing their rights.

While I cannot state definitively whether this is done out of bad faith or is a consequence of incompetence, the process for users to exercise their privacy rights has been made excessively difficult. The former is a blatant violation of the GDPR, the latter, though, puts into question whether an incompetent team should be put in charge of users' data in the first place.

The GDPR violation checklist

Skip this section if you prefer not to get into the specific legal articles

Based on DoubleCounter's practices and communications, here's a rundown of potential GDPR violations. This isn't fully exhaustive (the GDPR is quite massive!):

Article 5 (Principles relating to processing of personal data) : Violated through lack of transparency, fairness (misleading users), purpose limitation (using data collected for anti-fraud to power public tools like Doogle/Lens without consent), and data minimization (collecting/retaining data like alt links that may not be strictly necessary for the stated purpose, especially when shared publicly).

Article 6 (Lawfulness of processing) : The reliance on "legitimate interest" (6(1)(f)) appears very questionable, especially for sharing/selling data via Doogle/Lens and retaining links after deletion requests without a compelling, case-specific justification overriding user rights. The initial collection itself might lack a solid lawful basis due to misleading information provided at the time.

Article 7 (Conditions for consent) : While they primarily claim legitimate interest, the ads on their verification page likely rely on consent for cookies/tracking, which seemed flawed (buggy banner). More importantly, using data for Doogle/Lens, a purpose different from the original collection, requires fresh, informed consent, which was never requested nor acquired.

Article 15 (Right of access by the data subject) : Violated by the /privacy command failing to return all stored data (specifically, the known linked alt account ID) despite the policy promising a full copy.

Article 16 (Right to rectification) : Effectively hindered by staff initially claiming corrections (like unlinking wrongly associated household members) were impossible or couldn't be done, and not informing users of this right when inaccuracies were reported. If DoubleCounter wrongly linked two accounts, that is "the fault of the user". They are no longer able to interact in servers with global detection without having to ask a mod in that server each time.

Article 25 (Data protection by design and by default) : Arguably violated by designing systems (like Doogle/Lens and the oversharing DM "feature") that expose personal data by default, rather than prioritizing privacy from the beginning.

Article 32 (Security of processing) : While they claim encryption, the practice of sending usernames/IDs basically everywhere just shows not enough measures to ensure this "security".

A doxing tool fueled by ignorance

Let's call Doogle what it is in practice: A tool that facilitates doxing by exposing connections between potentially private or anonymous accounts. DoubleCounter might claim they're for "fraud prevention" 10 or "moderation", but the efficiency of Doogle relies almost entirely on an ethically dubious point: most users have no idea their data is being used this way . Doogle publishes sensitive information of users that they deliberately kept private, without the knowledge or consent of the users involved. There is a word to describe this: doxing .

DoubleCounter links this account to another based on IP or browser data.

Later, DoubleCounter launches Doogle/Lens and populates it with these previously collected links without telling the users or getting new consent.

This process bypasses informed consent entirely. The system works because users aren't aware they can (and likely would) opt out if properly informed. This can lead to:

Outing anonymous accounts used for sensitive communities.

Linking personal accounts to professional ones without a user's knowledge.

Exposing accounts used for private hobbies or interests (like the 18+ account example).

Allowing harassment by revealing connections someone deliberately kept separate.

They use information obtained outside Discord to do this verification - this isn't "public Discord information" if they get the data from outside sources. (As a matter of fact, Discord even actively tries to prevent IP leaks and fingerprinting by proxying literally everything through their own servers, even wiping metadata on images). The link between those IDs is the sensitive, non-public information they are exposing and selling access to. It's the connection itself that users often want to keep private, and DoubleCounter built features to make those connections searchable, making money on the fact users aren't aware of their data being shared like this. This isn't "fraud prevention", it's sharing data non-consensually for profit.

If you've ever verified with DoubleCounter, your personal data was collected under misleading terms, potentially exposed through tools like Doogle and Lens, and made available to others without your proper consent . Despite these serious privacy concerns being raised, DoubleCounter has shown little willingness to change their practices.

This is why we're gathering affected users to file a collective complaint with the French Data Protection Authority (CNIL). Your participation matters because data protection authorities prioritize cases affecting many users, and often regulatory intervention is the only way to ensure compliance when companies resist voluntary changes.

Join the complaint:

The form is really easy to complete, requiring only basic information. Your privacy matters, and by taking action today, you're helping ensure proper privacy practices when companies won't implement them voluntarily.

We also encourage you to file a complaint with your local Data Protection Authority or the CNIL directly if you're not in the EU.

CNIL Complaint (French only): (You can use your browser translation tool)

Local DPA (EU only): Find your local DPA here:

If you're part of a server that uses DoubleCounter, you can also let the server owner know the issues described here. Many server owners are not be aware of how incredibly invasive DoubleCounter's practices are, and simply want to protect their communities. Helping them understand the full picture can make a big difference.

Conclusion: Systematically disregarding user privacy for profit

The business model of DoubleCounter, operated by "Tellter SAS", apparently prioritizes revenue over fundamental user privacy rights. Having a reported revenue of 400,000$ in 2022 2 , their business model appears heavily reliant on violating a bunch of GDPR articles.

From misleading privacy policies and inaccurate statements data handling, to the creation of public-facing tools like Doogle that expose private data without proper consent, their actions repeatedly disregard user's rights. Their justification of "legitimate interest" for fraud prevention is difficult to argue with the reality of data being widely shared, sold through subscriptions, and used in ways that can cause direct harm, such as revealing private information.

The concept of preventing ban evasion on Discord is understandable, but the stuff that DoubleCounter does on top of that raises so many serious ethical and legal concerns. It's so incredibly important that Tellter makes changes, including genuinely respecting user rights, getting informed consent, removing privacy-invasive features like Doogle, and prioritizing user privacy over profit.

None of the data that DoubleCounter collected was ever allowed to be shared like this.

We are preparing a report for the Data Protection Authority regarding DoubleCounter. If you feel your privacy rights have been infringed in any way, please use this form to submit your information: .

If there is anything else, you can get in with me by sending an email to [email protected] or contacting me on Discord ( @lina.sh ). I also have a Discord server if you want to stay updated and chat with others this: .

This research took quite some time and effort. I spent way over two weeks on this, and I want to thank the following people for their help:

This entire post was sent to DoubleCounter to check for any errors. I corrected all factual errors they pointed out if they were indeed wrong, otherwise there will be a behind the source. It is important to note that DoubleCounter still insists that Discord IDs aren't PII, even though that is completely irrelevant to the GDPR. They are personal data, and they are protected by the GDPR.

They claim this themselves on their front-page: ↩

This information is taken from the website of the parent company, Tellter. Scroll to the bottom to see that DoubleCounter has an ARR (= Annual Recurring Revenue) of 400,000$ from DoubleCounter alone. from DoubleCounter: "Your stats are correct except for the revenue, which is outdated and actually much less now. It is intentionally left as is for marketing purposes, but in fact corresponds to our best year all-time, 2022 :D I've always liked been super transparent on everything, so if you want further details on this, you can check this Discord thread on No Text To Speech's server, where I discussed this in the past: link ; It even contains extracts of our cash flow statements! We currently have a bit higher revenue than in the thread, $9000/month with still $4K to $5K in costs. After French taxes, we're quite far from the "half a million USD" headline, even though I would love for it to be real!" We have corrected the blog post to point out this data is from 2022. We find it very misleading to put this on their website, and then to basically say that our stats are incorrect. ↩ ↩

Taken from their Discord Application Page, these numbers come officially from Discord ; As of 2024-04-28, it was in 525k servers. ↩

This is taken from Tellter's DoubleCounter page ↩ ↩

This specific case is explained, for example, in §22 of their Guidelines on pseudonymisation ↩

They sell a Pro tier for 8.49$/month, and an Ultimate tier for 14.99$/month. ↩ ↩

This is according to GDPR Article 3 (1) ↩

This is according to GDPR Article 4 (1) ↩ ↩

↩ ↩ ↩ ↩ ↩ ↩ ↩ ↩

This is according to GDPR Article 17 ↩

↩

Phew, it's quite a few emails, we compiled a ZIP file containing all original .eml files. On top of this, we provide an "easy-to-read" text transcript . ↩ ↩ ↩ ↩

You can view the chat transcript we had with their support team here ↩

This is according to GDPR Article 6 (1) (f) ↩

They announced Doogle on 2024-09-19 , I check my own messages with DoubleCounter and checked with friends, no one received an information of their data now being used like that. ↩

This is according to GDPR Article 12 ↩

This is according to GDPR Article 21 (4) ↩

This poll was done on the Project: Renaissance Discord server. The server has 800 members. I would really like to thank Catchy, who is credited, for willing to make this poll! ↩

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Double Counter Breach Exposes 1M Discord User Emails and IDs On October 4, 2026, the Discord security bot Double Counter experienced a breach that exposed approximately 1 million email addresses and data linked to around 28 million Discord accounts. The attack was described as a 'deliberate, multi-stage attack' where hackers exploited a vulnerability in a legacy analytics tool, gaining access to cloud credentials and copying about 12 GB of data. The attackers also hijacked Double Counter's Discord bot token, using it to post malicious links across 50 large Discord servers. While Discord itself was not directly breached, the incident raises concerns about the security of third-party applications. Double Counter has since restored service and is under continuous monitoring. The breach also involved financial fraud using a stolen payment key, with $7,316 reported in fraudulent charges. The incident highlights ongoing vulnerabilities in third-party services associated with major platforms like Discord. 6 sources 55

Extracted Entities

Doublecounter Is Violating Your Privacy

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Countries (1)

CWE Weaknesses (1)

Domains (2)

Email Addresses (1)

Platforms (1)