This actually speaks to one of the concerning things about this law. There is a section forbidding developers from collecting additional information (unless they have confident information that your age is incorrect). But there is no such clause for OS providers.

Developers shall not "Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this title."

Or

"Share the signal with a third party for a purpose not required by this title."

This means that discord could not collect IDs or face scans without confidence that your age is incorrect. But windows can still require whatever they want.

But I guess silver lining is that neither of them can sell or even share the data with 3rd parties. Pretty minimal silver lining though.