Home › Resources

Discord Bot Privacy Policy: What Discord Requires and How to Write One

Published August 27, 2026

Discord requires every bot to have a privacy policy under its Developer Policy, and a working policy URL becomes mandatory once your bot needs verification -- at 100 servers -- or gets listed in the App Directory. It has to describe what your bot actually collects: user IDs, server and channel IDs, message content if you use that intent, voice state, and anything you log or store. A generic template copied from a website's terms page will not pass review.

This guide covers when Discord requires the policy, what data your bot handles that developers routinely forget to disclose, how a 2026 change to Discord's privileged-intent rules affects your Message Content disclosure, and where to host it. Rather generate one than write it from scratch? Generate a privacy policy for free and host it at no cost.

When Discord Requires a Privacy Policy for Your Bot

Discord's Developer Policy applies to every application registered in the Developer Portal, bots included, and requires a publicly accessible privacy policy that clearly and accurately describes how the application collects, uses, and shares user data. That obligation exists from the moment you create the application, not once the bot gets popular.

Three moments make it non-negotiable:

• Bot verification. Required once a bot reaches 100 servers; an unverified bot cannot join more servers past that point. The App Verification checklist lists a working privacy policy alongside Stripe identity verification for the team owner -- start early, since review takes real time.
• App Directory discovery. To be discoverable, your application must have a connected, publicly available privacy policy and terms of service in addition to being verified -- a baseline eligibility gate, not an optional nicety.
• Every other bot, technically. The Developer Policy carves out no exception for small or single-server bots. Enforcement is lighter below the verification threshold, but the obligation applies at any scale.

This is the same pattern Amazon uses for Alexa skill certification and Google uses for Chrome Web Store listings -- the platform gatekeeps the policy, and reviewers check that it matches what the application does rather than just confirming the URL field is filled in.

What Data a Discord Bot Collects

Most developers under-disclose because they think about what they store in a database, not what Discord sends their bot in the first place. Your policy needs to cover both.

• User IDs and usernames. Every message, reaction, or slash command carries the Discord user ID and current username of whoever triggered it -- a persistent identifier, so it is personal data before you ever save it.
• Guild and channel IDs. These identify where an interaction happened, and combined with a user ID reveal which servers someone uses your bot in.
• Message content, if you request the intent. Without MESSAGE_CONTENT, your bot only sees text it is mentioned in, a DM, or a slash command. Enabled, every message in every visible channel passes through your code, logged or not.
• Voice state. Music and voice bots use the standard (non-privileged) GUILD_VOICE_STATES intent to know who joined or left a voice channel -- personal data, even though it skips the privileged-intent review.
• Member lists and presence. GUILD_MEMBERS and GUILD_PRESENCES hand your bot a full roster or users' online status -- far more than most bots need.
• Logs. Console and error logs often contain user IDs or message snippets by accident -- data storage, whether intended or not.

The distinction that trips developers up: receiving data through the Gateway is processing, even when nothing touches a database. A stateless bot still needs a policy describing what it receives and why.

The Message Content Intent Review and Your Privacy Disclosure

Message Content, Guild Members, and Presence are Discord's three privileged intents -- gateway access Discord does not hand out automatically, because each exposes data most users would not expect a bot to see. Any bot using one needs to justify it, and the privacy policy is part of that justification.

Discord changed how that review works in 2026. Previously, the trigger was server count: bots under 100 servers could self-toggle privileged intents, and bots at 100 or more applied for approval as part of bot verification itself. As of June 2026, Discord separated the two processes and moved the intent-review trigger to unique user count across all of a bot's servers instead. Under 10,000 total users, you can still self-toggle. Past that, the owner is notified and has 90 days to submit a review explaining the bot's use case per intent, and approved bots must now reapply annually.

None of this changes what data the intents expose -- only when Discord reviews the justification. Your policy obligation does not wait for that review: if MESSAGE_CONTENT is enabled, it needs a line explaining why the bot reads messages, whether content is stored or only processed in memory, and for how long, at 50 users or 50,000. Bots that only need it to catch a command prefix should migrate to slash commands instead, dropping the privileged intent -- and the disclosure burden -- entirely.

What Your Bot's Privacy Policy Must Include

Name the bot specifically -- a generic document that never mentions it by name is an easy rejection reason during review. Beyond that, these sections cover what Discord and standard privacy law both expect.

• What data you collect, in plain terms rather than "we may collect certain information."
• Why you collect it. Tie each data type to a feature; if you cannot name a reason, stop collecting it.
• Who else receives it -- your host and any AI provider your bot calls if messages leave Discord for processing. Discord bars selling API data or handing it to brokers -- say you do not, if true.
• How long you keep it. Real periods ("moderation logs, 12 months"), not "as long as necessary," and what happens when the bot is removed from a server.
• User rights. How someone gets a copy of their data or has it deleted, and which rights apply under GDPR and CCPA.
• Children's privacy. Discord's minimum age is 13 -- state the bot is not directed at under-13s.
• Contact and change notice. A working contact method and how you will announce policy changes.

Not sure which of these actually apply to your bot's audience? A quick compliance check based on your platform and users narrows it down faster than reading every regulation yourself.

Hosting Your Policy and Adding It to the Developer Portal

The policy needs a stable, public URL. Google Docs, Notion pages, and Pastebin links are a poor fit -- they can change, go private, or disappear, exactly what Discord's reviewers watch for. Three options hold up:

• Your bot's own site -- a path like yourbotname.com/privacy. Full control, no third-party dependency.
• A free generated policy -- if you have no website, generate and host one for free and link straight to the permanent URL.
• GitHub Pages -- a static HTML page in a public repo, common for open-source bots, as long as it renders without a GitHub login.

Adding the URL takes four steps: open the Developer Portal and select your application; click General Information; paste the full URL (including https://) into the Privacy Policy URL field; save. That URL shows during your bot's OAuth2 authorization flow, and it is the same field verification and Discovery reviewers check. If your data practices change, update the policy and bump the modified date before your next reapplication, not after.

Sample Discord Bot Privacy Policy You Can Copy

A template for a fictional bot, "[Your Bot Name]." Copy it, fill in the brackets, and delete anything that does not apply.

Bots with payments or AI integrations need a dedicated section for each. Want a policy built from your bot's actual practices instead? Build one for free with the generator.

Frequently Asked Questions