Digital identity verification now hinges on liveness, age checks and choice

At a glance

What this is: This is a Yoti analysis of how remote identity verification is being shaped by passive liveness, age assurance accuracy, and choice across digital ID routes.

Why it matters: It matters because IAM and identity verification teams now have to balance proof strength, false positives, and user experience across document, biometric, and wallet-based identity journeys.

By the numbers:

• Yoti says its MyFace passive liveness model achieved 0% APCER at both Level 1 and Level 2 in iBeta testing.
• Yoti says its MyFace passive liveness model achieved 0% BPCER at both Level 1 and Level 2 in iBeta testing.
• Yoti says its facial age estimation has a 0.6% false positive rate for 13 to 17 year olds being estimated as over 21.
• Yoti says 60% of 18 year olds and 80% of 19 year olds will pass the over 17.5 year check.

Context

Digital identity verification is being pulled in two directions at once: stronger assurance on one side, and less user friction on the other. In this article, Yoti focuses on passive liveness testing, facial age estimation, and the policy question of whether citizens should be able to choose between government and private-sector digital ID routes.

For IAM and identity verification programmes, the core problem is not simply whether a control works in a lab. The harder question is how to set acceptable thresholds, false positive tolerance, and fallback routes when verification must support age-restricted content, right-to-work checks, or high-volume consumer onboarding.

Key questions

Q: What breaks when age assurance relies only on a single verification method?

A: A single method can fail when users cannot complete it, when risk levels vary across sessions, or when borderline results need a stronger control. That creates false rejects, inconsistent assurance, and poor user experience. Mature programmes use a waterfall approach so the platform can step users up to another method when the first signal is inconclusive.

Q: Why do digital identity programmes need explicit acceptance rules for choice?

A: Choice only works when every accepted route is mapped to the same assurance outcome. Without explicit rules, government IDs, private-sector credentials, and physical documents can be treated as interchangeable even when they are not. That creates uneven trust, inconsistent enforcement, and hidden assurance gaps across the relying party workflow.

Q: How do security teams evaluate whether liveness detection is strong enough?

A: Look for measurable resistance to presentation attacks, defined false accept and false reject rates, and testing that reflects the real environment where the control will run. A good evaluation also includes exception handling, logging, and whether staff can bypass the control when operations become urgent.

Q: What should organisations do when facial age estimation is close to the policy threshold?

A: They should treat the threshold as a policy decision, not a model artefact. If a result falls near the cutoff, the relying party should define whether to challenge the user, accept a lower-risk action, or require stronger proof. That keeps the decision consistent and defensible across transactions.

Technical breakdown

Passive liveness vs active liveness in identity verification

Passive liveness checks whether a selfie comes from a live person without asking the user to perform a challenge. Active liveness asks the user to blink, turn, smile, or otherwise respond to prompts. The technical trade-off is between user experience and attack resistance. Passive liveness is easier to complete at scale, but it must still defeat spoofing, replay, and presentation attacks to meet assurance thresholds such as ISO 30107-3 PAD testing. In practice, the control works best when the verification flow is paired with strong policy around retry handling, device trust, and escalation to document-based proofing when confidence drops.

Practical implication: treat liveness mode as a policy decision tied to risk, not a universal default.

Age estimation buffers and false positives

Age estimation does not prove exact age. It estimates a likely age band, then uses a buffer to decide when to challenge the user for stronger proof. That makes the buffer a governance control, not just a model parameter. A tighter buffer reduces underage pass-through risk but increases the number of adults who are wrongly challenged. A wider buffer improves convenience but weakens protection for minors. For practitioners, the meaningful question is where the threshold sits for the specific use case, and how often the false positive rate pushes legitimate users into a higher-friction verification path.

Practical implication: set age thresholds by policy outcome, then test the friction and false-positive trade-off.

Digital ID choice and federated proofing routes

The article also points to a broader identity design pattern: users may prove identity through government, certified private-sector, or physical-document routes, provided the underlying proofing standard is equivalent. That is a federation and assurance question, not a branding question. The real control point is whether the relying party can trust the credential source, verify the claim against an authoritative database, and retain consistent acceptance rules across channels. In mixed ecosystems, the technical challenge is aligning trust frameworks so that one route does not silently become weaker than the others.

Practical implication: standardise acceptance criteria across proofing routes so choice does not dilute assurance.

NHI Mgmt Group analysis

Age assurance is becoming an assurance-routing problem, not a single-control problem. The article shows why organisations cannot treat liveness, age estimation, and document proofing as separate features. Each route creates a different balance of friction, fraud resistance, and decision confidence. The practical conclusion is that IAM teams need a governance model for selecting the right proofing route by risk, not by convenience alone.

Passive liveness changes the user experience equation, but it does not remove the need for policy thresholds. A low-friction selfie flow may improve completion rates, yet the security question remains whether the control can reject spoofing without over-rejecting genuine users. That makes liveness acceptance criteria part of identity policy design. Practitioners should stop treating biometric convenience as the same thing as security sufficiency.

Identity choice only works when trust equivalence is explicit. The article’s digital ID discussion points to a common governance failure: assuming that multiple credential routes are interchangeable without proving that they share the same proofing standard. That assumption breaks quickly once government, private-sector, and physical credentials coexist. The implication is that relying parties must define acceptance rules before they scale choice.

Choice is now a governance control, not a user-experience afterthought. If citizens can present government ID, certified private-sector ID, or a physical document, then the programme has to decide which routes are acceptable for which transactions. That requires policy clarity, claims validation, and consistent fallback handling. The practitioner takeaway is that choice only reduces friction when the control framework is already explicit.

Age checks expose the same structural tension seen across modern identity programmes. Higher assurance often means more user challenge, while lower friction can enlarge the residual risk window. Yoti’s figures illustrate that this is no longer theoretical in age-restricted content and right-to-work use cases. Teams should treat threshold setting as a core assurance decision, not a tuning exercise.

What this signals

Assurance routing will matter more than model branding. Identity teams should expect the conversation to shift from which biometric or document method is newest to which route is defensible for a specific transaction. That means policy owners need clear acceptance thresholds, fallback sequences, and auditability across every identity path.

Age checks will increasingly be evaluated as policy systems. The technical question is not just whether a model can estimate age, but whether the organisation can tolerate the resulting friction and residual error. As regulators and platforms tighten controls, the strongest programmes will be the ones that make the threshold logic explainable.

For digital identity and age assurance teams, the next phase is about harmonising user choice with assurance equivalence. If choice expands faster than governance, the programme becomes easier to use but harder to defend.

For practitioners

• Define proofing route policy by transaction risk Map each verification journey to an acceptable route, such as passive liveness, active liveness, document proofing, or wallet-based credential presentation. Use the same acceptance logic across channels so a lower-friction path does not silently reduce assurance for the same transaction type.
• Set age thresholds by measurable false-positive tolerance Choose the buffer and escalation path based on the business impact of underage access versus the cost of over-challenging adults. Review the threshold separately for social platforms, adult content, and right-to-work flows because the acceptable error profile is not the same.
• Standardise fallback routes for failed liveness checks Define what happens when passive liveness fails, including retry limits, switch to active liveness, and escalation to document verification. Keep the fallback sequence consistent so users are not left in an ambiguous state that undermines trust and completion rates.
• Document equivalence criteria across digital ID sources Write down the assurance standard that a government credential, certified private-sector credential, or physical document must meet before it is accepted. Apply the same criteria to every relying party decision so choice remains a governance feature rather than a loophole.

Key takeaways

• The article shows that identity verification is moving toward route selection, where liveness, age estimation, and document proofing must be governed by transaction risk.
• Yoti’s reported testing results highlight the operational tension between strong fraud resistance and low-friction user journeys, especially in age-restricted and high-volume use cases.
• Practitioners should define equivalence criteria and fallback rules before they expand digital ID choice or loosen age-check thresholds.

Key terms

• Passive Liveness: Passive liveness is a verification method that checks whether a biometric sample appears to come from a live human without requiring the user to perform actions. It reduces friction, but it still depends on the integrity of the capture and analysis path. If that path is manipulated, passive liveness alone will not protect the decision.
• Age Estimation Review: A formal review of how an age estimation method performs and whether it meets regulatory expectations. In identity systems, this usually examines accuracy, process fairness, and evidence quality so regulators and stakeholders can assess whether the method is suitable for sensitive use cases.
• Age Buffer: An age buffer is a safety margin placed above a legal age threshold to reduce misclassification risk. For example, a service may treat users as 23+ when the legal access rule is 18+. This gives operators room for model error while preserving the intended policy outcome.
• Identity Route Equivalence: The principle that different identity proofing routes can be accepted only when they meet the same assurance standard for the same transaction. It matters when government credentials, private-sector credentials, and physical documents coexist in one programme and must produce comparable trust outcomes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.