Digital ID growth and age assurance controls are converging

At a glance

What this is: Yoti says digital ID wallet adoption, age assurance usage, and liveness controls are all scaling together, with stronger evidence that trust signals are becoming operational at volume.

Why it matters: IAM and identity governance teams need to understand how digital identity wallets, age verification, and proofing controls change assurance, re-authentication, and policy design across public and private use cases.

By the numbers:

• Revenues grew 62% in 2025 to £29.0 million, up from £17.9 million in 2024.
• Global downloads of the Yoti Digital ID wallet increased from 1.62 million in 2024 to 5.55 million in 2025.
• UK downloads grew from 1.00 million in 2024 to 2.02 million in 2025.

Context

Digital ID wallets and age assurance controls are moving from niche deployment patterns into mainstream identity infrastructure. In this article, Yoti links wallet growth, verified credentials, liveness assurance, and policy change to a broader shift in how identity proofing is being operationalised across government and private-sector use cases.

For IAM and identity governance teams, the practical issue is not whether these controls exist, but whether they can be trusted for repeated use, re-authentication, and age-verification workflows at scale. The article argues that certified wallets and facial assurance models are increasingly part of the control stack, not just adjacent user experiences.

Key questions

Q: How should organisations govern business wallets in regulated identity programmes?

A: They should treat business wallets as part of the identity governance stack, not a side channel. That means defining authoritative sources for attributes, approval rules for issuance, revocation handling, audit retention, and ownership across IAM, IGA, and compliance. Without those controls, portable identity evidence can create a second, less visible identity estate.

Q: Why do liveness checks matter more as identity moves online?

A: They matter because digital journeys remove face-to-face confirmation, which used to provide a basic reality check. Once verification becomes remote, attackers can reuse photos, replay video, or inject fake media. Liveness restores part of that assurance by tying the decision to a live capture event.

Q: How should teams evaluate facial age estimation models before deployment?

A: Teams should use a separate, representative test set to evaluate whether a facial age estimation model generalises beyond the data it was trained on. That test set should reflect real world variation in age, skin tone, lighting, and spoofing attempts. Without independent testing, a model can look accurate through memorisation while failing users in production.

Q: What should IAM teams do when digital ID and age checks are reused across services?

A: Establish a clear trust policy for reuse so each service knows whether a prior verification can be accepted or must be refreshed. Reuse changes the control model because assurance can decay over time, channel, and context. IAM teams should align credential presentation, re-authentication, and assurance level to the risk of the transaction.

Technical breakdown

Digital ID wallets as a trust layer for repeated verification

A digital ID wallet stores verified attributes or credentials that can be presented again without repeating full identity proofing every time. The technical shift matters because the wallet becomes a trust container for reuse, re-authentication, and selective disclosure. Yoti’s article reflects a market where wallet downloads and certified use cases are becoming more common, which moves the control question from one-time identity proofing to lifecycle governance of reusable digital credentials. For practitioners, the relevant issue is not just issuance but whether the wallet, the credential, and the relying party all preserve assurance after initial enrollment.

Practical implication: Treat wallet-based identity as a governed credential lifecycle, not a one-time onboarding event.

Liveness checks and presentation attack detection for age assurance

Liveness checks are designed to determine whether the subject facing a camera is a live person rather than a replay, mask, or synthetic presentation attack. Presentation attack detection is the broader control objective, and it matters because age assurance depends on stopping spoofing before an attribute decision is made. Yoti’s article emphasizes ISO/IEC 30107-3 Level 3 testing, which is specifically aimed at harder attack conditions. For identity teams, the operational question is how much assurance the capture layer adds before the age decision is trusted downstream.

Practical implication: Use presentation attack resistance as a gating control before accepting biometric age signals.

Facial age estimation and the limits of probabilistic identity signals

Facial age estimation does not prove identity in the same way that a document or credential does. It estimates an age range from facial characteristics, which makes it a probabilistic signal rather than a deterministic one. That distinction is important in governance because age assurance often combines proofing, liveness, and estimated attributes, and each layer carries different error and policy implications. Yoti’s discussion of NIST performance tables underscores that image quality, face size, and evaluation conditions materially affect accuracy. For practitioners, that means policy must define where estimation is acceptable and where stronger proof is required.

Practical implication: Separate age estimation policy from identity proofing policy so different assurance levels are enforced correctly.

Threat narrative

Attacker objective: The objective is to bypass age or identity controls by convincing the relying party that an unqualified presenter is a legitimate verified user.

1. Entry occurs when a relying party accepts a claimed identity or age attribute for a digital wallet workflow without sufficient assurance about the presenter or credential source.
2. Credential abuse follows if spoofed images, replayed selfies, or weakly governed reusable credentials are accepted as evidence of live presence or attribute ownership.
3. Impact is misissued access, age-gated service failure, or unauthorized account creation at scale when the assurance layer is treated as stronger than it really is.

Breaches seen in the wild

• Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
• United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Digital ID wallets are becoming a lifecycle problem, not just a registration problem: once a wallet is used for repeated proofing, re-authentication, or age checks, the control plane shifts from initial enrollment to ongoing trust governance. That changes what identity teams must monitor, because acceptance decisions now depend on the persistence and reuse of credentials rather than a single verification event. The practitioner conclusion is that wallet assurance must be governed as a living identity state.

Age assurance should be treated as an assurance chain, not a single control: proofing, liveness, credential presentation, and relying-party policy each contribute different failure modes. If any one layer is assumed to settle the whole decision, the governance model becomes too brittle for regulated use cases. The practical conclusion is that teams need explicit boundaries for when facial signals are sufficient and when stronger evidence is required.

Verified credentials expand digital identity adoption only when trust is legible to the relying party: a wallet is useful only if downstream systems can understand what was verified, when it was verified, and under what assurance conditions. That makes metadata, policy enforcement, and interoperability part of the security model rather than afterthoughts. The practitioner conclusion is that portability without trust semantics creates confusion, not assurance.

Presentation attack resistance is now a baseline requirement for any age-gating workflow that depends on selfie capture: if a system cannot distinguish a live subject from an engineered presentation, the age decision is built on unstable evidence. Yoti’s emphasis on higher-level testing reflects where the market is heading, namely toward stronger capture-layer assurance as fraud pressure rises. The practitioner conclusion is to validate the capture layer before trusting the downstream policy.

Facial age estimation needs a narrower policy envelope than vendors often imply: an age estimate is useful only when the error tolerance, image conditions, and business consequence are all explicitly defined. Without those boundaries, organisations risk turning a probabilistic signal into a de facto identity proof. The practitioner conclusion is to anchor use-case policy to assurance thresholds, not convenience.

What this signals

Wallet adoption changes the governance problem: once identity lives in a reusable credential container, the key question becomes how relying parties validate freshness, provenance, and policy fit before accepting it. That is why wallet programmes need lifecycle controls, not just enrollment logic.

Age assurance is moving toward layered evidence: organisations should not rely on a single signal, whether document check, selfie, or estimated age. The stronger model is to define which signals can be combined, where each is authoritative, and when a higher-assurance step is mandatory.

For practitioners

• Define wallet trust boundaries Specify which relying-party decisions may use digital ID wallet credentials, which require re-authentication, and which must still fall back to stronger proofing. Keep the wallet lifecycle separate from initial identity proofing.
• Validate liveness controls against spoofing Test selfie capture and presentation attack detection against replay, mask, and synthetic attack conditions before approving age assurance in production. Require evidence that the model performs under the image quality your channels actually produce.
• Set explicit age-estimation policy thresholds Document where facial age estimation is acceptable, what error tolerance is allowed, and which services need higher-assurance checks. Avoid using probabilistic age outputs as a substitute for identity proofing.
• Map verified credential use to re-authentication rules Decide when a presented credential is sufficient for repeat access and when a fresh verification event is required. Re-authentication should reflect the sensitivity of the transaction, not just the convenience of the wallet.

Key takeaways

• Digital ID wallets and age assurance are converging into a single governance problem where reuse, re-authentication, and assurance quality must all be controlled.
• The article points to stronger adoption, but the bigger operational issue is whether relying parties can tell which trust signal they are actually consuming.
• Practitioners should separate probabilistic age estimation from identity proofing and reserve each for the policy outcomes they can genuinely support.

Key terms

• Digital ID Wallet: A digital ID wallet is a software container that stores and presents identity credentials for a person or organization. It can hold verified attributes, certificates, and attestations, then share them selectively with relying parties. In identity systems, it supports controlled disclosure, authentication, and verification while reducing repeated manual identity checks.
• Age Assurance: Age assurance is the set of controls used to determine whether a person can access content or services restricted by age. It can include document checks, biometrics, in-band verification and decision logging, but the governance requirement is the same: the organisation must be able to justify the outcome.
• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.
• Facial Age Estimation: Facial age estimation uses a selfie or live camera image to estimate whether a person is above or below a required age threshold. It is a probabilistic verification method, so its governance depends not only on model accuracy but also on how the image is captured, processed, retained, and disclosed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.