Yoti dispute shows age verification privacy claims need stronger evidence

At a glance

What this is: This is Yoti’s public rebuttal to academic and university publication claims about its age verification service, centred on whether facial images are shared with third parties.

Why it matters: It matters because identity verification teams need defensible evidence for data handling, retention, and third-party exposure, especially where biometric processing sits close to privacy, compliance, and trust decisions.

By the numbers:

• Our systems hold SOC2, ISO 27001, ISO 27701 and ISO 9001 certifications.

👉 Read Yoti’s response to the age verification privacy allegations

Context

Age verification creates a governance problem when biometric processing, device signals, and third-party risk are discussed without clear evidence of how data actually moves. In this case, the central question is not whether identity assurance is used, but whether claims about facial image sharing are supported by technical proof.

For identity verification and privacy teams, the important issue is the boundary between collection, processing, deletion, and disclosure. Where a service claims that facial images never leave its systems, practitioners should treat that as an auditable control claim, not a marketing statement. The starting position here is atypical because it is a dispute over alleged data sharing rather than a confirmed product disclosure failure.

Key questions

Q: How should security teams evaluate privacy claims in age verification systems?

A: They should ask for evidence of how biometric data is captured, processed, stored, deleted, and audited. The key test is whether the provider can prove that facial images stay inside the intended environment and are not exposed to third parties, including subprocessors, logs, and analytics paths.

Q: Why does age verification become an identity governance issue?

A: Age verification becomes an identity governance issue when the organisation must prove policy compliance, retain evidence, and defend decisions after the user has been admitted. At that point the control is no longer just onboarding. It is a repeatable assurance process with accountability, reviewability, and lifecycle implications.

Q: What do organisations get wrong about inclusive biometrics?

A: They often assume that a vendor’s accuracy claim is enough. In practice, inclusivity depends on how the system performs across real users, whether accessibility constraints are addressed, and whether bias is monitored after rollout. Without those controls, the organisation can ship a system that works for most users and still fails at the point of access for many others.

Q: Who is accountable when disputed identity verification claims damage trust?

A: Accountability sits with the provider for control evidence, with the publisher for factual accuracy, and with the buyer for verifying claims before deployment. In regulated environments, teams should treat documentation, auditability, and contract terms as part of the accountability chain.

Technical breakdown

How age estimation systems process biometric data

Age estimation services typically capture a facial image, run it through a model or ruleset to infer an age band, and then return a decision or confidence result. The governance risk is not the model itself but the surrounding data path: ingestion, transient storage, logging, and any handoff to processors or analytics systems. If the architecture is designed so the image is processed only inside the provider’s environment, the control question becomes whether that claim can be independently validated across the full request lifecycle.

Practical implication: verify the full biometric data path, including temporary storage and logs, before accepting any privacy assurance.

Third-party exposure and identity verification controls

Identity verification systems often rely on device fingerprinting, risk scoring, and external checks, which can create confusion between internal processing and onward disclosure. A service may use third-party infrastructure without sharing biometric content, but practitioners need evidence that the scope is limited to the intended transaction. The relevant control problem is data minimisation with verifiable segregation, especially when regulators and customers expect a clear answer on who can access what and for how long.

Practical implication: document every processor, subprocessor, and telemetry path that touches verification data.

Auditability in privacy-focused identity platforms

Auditability is the difference between a privacy claim and a defensible control. For age assurance and digital identity platforms, independent testing, certification, and repeatable inspection should show whether facial images are deleted promptly, whether access is restricted, and whether no hidden export path exists. That matters because identity trust depends on the ability to prove negative claims, such as that sensitive biometric data is not shared onward.

Practical implication: require evidence packs that include deletion timing, access logs, and independent audit results.

Threat narrative

Attacker objective: The apparent objective is to convince the market that the age verification platform mishandles facial data and exposes users to third-party sharing risks.

1. Entry would occur through the publication and amplification of a privacy allegation about biometric processing and third-party sharing.
2. Escalation follows when the allegation is repeated across articles, institutional statements, and public commentary, creating wider trust damage than the original claim.
3. Impact is reputational and governance-related, because the debate shifts from technical verification to whether the platform can prove its data handling controls.

NHI Mgmt Group analysis

Biometric privacy claims now require proof, not positioning. Age verification sits at the intersection of identity verification, privacy law, and trust engineering, so claims about image handling must be testable. When a provider says facial images are deleted immediately and never shared, the burden is on evidence that a practitioner can review, not on corporate confidence alone. The practitioner conclusion is simple: treat biometric handling as a control assertion that must be independently validated.

Verification trust gap: the real risk is not just data collection, but unverifiable data flow. Identity and age assurance programmes fail when teams cannot distinguish internal processing from onward disclosure. That gap becomes material under GDPR, security audit expectations, and customer due diligence, because privacy assurances lose value when the data path is not observable end to end. The practitioner conclusion is to require evidence of segmentation, retention, and disposal, not just policy language.

Independent auditability is the control that separates assurance from assertion. The article makes clear that certification and external scrutiny are now part of the market expectation for identity platforms handling biometric data. That aligns with the broader direction of privacy governance: systems must prove how sensitive data is processed, stored, and destroyed. The practitioner conclusion is to make audit artefacts a procurement requirement, not a post-incident request.

Age verification vendors are being judged on data minimisation as much as on accuracy. This changes the governance lens for digital identity programmes. Accuracy alone does not settle privacy risk if the platform cannot demonstrate tight processing boundaries and restricted disclosure. The practitioner conclusion is to evaluate verification services as data-governance systems, not just as identity-checking tools.

What this signals

Verification trust gap: identity assurance programmes increasingly live or die on whether teams can evidence data handling, not just state it. For organisations evaluating biometric or age assurance services, the governance question is whether the platform can prove deletion, segregation, and subprocessor boundaries with artefacts that survive audit.

That shift matters for programmes that already struggle with sensitive data flows. The same discipline used in NHI governance applies here: control design, access limits, and audit trails need to be visible enough for procurement, legal, and security review to trust them.

As identity systems become more data-rich, teams should expect more scrutiny of privacy claims and more demand for proof. In practice, that means building review criteria around evidence packs, retention controls, and independent testing rather than headline assurances.

For practitioners

• Map the biometric data flow end to end Document where facial images enter, where they are processed, where they are stored temporarily, and where they are deleted. Include logs, monitoring, analytics, backups, and any subprocessor that could see verification artefacts.
• Require independent evidence for privacy claims Ask for audit reports, test attestations, and deletion-verification evidence that confirm facial images do not leave the provider’s environment. Do not accept policy statements without control evidence.
• Review third-party and subprocessor boundaries Validate whether any external services touch device fingerprints, metadata, or decision outputs, and confirm the contractual scope for each processor. Where possible, align this review with the OWASP Non-Human Identity Top 10 and the NIST SP 800-53 Rev 5 Security and Privacy Controls.
• Separate privacy assurance from vendor reputation Build procurement criteria around retention, deletion, access logging, and assurance artefacts rather than claims about trust or transparency. A service that handles biometrics should be able to show control design, not just describe intent.

Key takeaways

• Age verification disputes increasingly hinge on whether biometric data handling can be proved, not merely claimed.
• The governance risk is the unverifiable data path, especially where third-party access, logging, and retention are not transparently controlled.
• Practitioners should require audit artefacts, deletion evidence, and processor maps before trusting any privacy-focused identity platform.

Key terms

• Age Assurance: Age assurance is the set of controls used to determine whether a person can access content or services restricted by age. It can include document checks, biometrics, in-band verification and decision logging, but the governance requirement is the same: the organisation must be able to justify the outcome.
• Biometric Data Flow: Biometric data flow is the path sensitive biometric information follows from capture to processing, storage, deletion, and any onward disclosure. Security teams use it to identify hidden exposure points such as logs, analytics tools, subprocessors, and backup systems that can undermine privacy claims.
• Activation Trust Gap: The activation trust gap is the difference between trusting data because it is protected and governing it because it is being reused. It appears when organisations move data from backup or archival systems into AI pipelines without reapplying access, sensitivity, and consumer controls.

What's in the full analysis

Yoti's full post covers the factual dispute and the technical assertions this analysis intentionally leaves at source:

• The exact language Yoti uses to dispute the university claims about facial image sharing and deletion.
• The broader correspondence context, including requests for correction, apology, and retraction.
• Yoti's description of its certifications, audit approach, and bug bounty context.
• The full wording of the allegations and the response letter sent to the institutions.

👉 The full Yoti statement sets out the disputed claims, the audit context, and the requested corrections.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives practitioners a practical foundation for strengthening identity control across verification, access, and lifecycle programmes.