Topic starter
30/07/2026 11:23 pm
TL;DR: Researchers and university articles falsely claimed an age verification platform shares facial images with third parties, while the company says images are processed inside its own systems and deleted immediately after age estimation, according to Yoti. The dispute shows why identity verification governance depends on auditability, data-flow proof, and careful handling of privacy claims, not vendor assertions alone.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “An open letter to Georgia Institute of Technology and University of California, Irvine requesting retraction and correction of false statements”.
Key questions
Q: What should teams do when an identity vendor's privacy claims are disputed?
A: Treat the dispute as an evidence review, not a branding problem.
A: Traditional methods often fail because a birthdate is easy to guess or falsify, while more invasive checks can collect more data than the use case requires.
Q: What signs show that an identity privacy claim is weak?
A: Vague statements about deletion, missing retention evidence, unclear third-party disclosure paths, and no independent validation are all warning signs.
Practitioner guidance
- Verify the data flow, not the claim Request architecture diagrams, retention schedules, and access logs that show exactly where facial images are processed, stored, and deleted.
- Require independent processing evidence Ask for testable proof that raw images, templates, and derived signals never leave the defined processing boundary for third-party use.
- Tie privacy assurance to procurement gates Make privacy evidence a go or no-go criterion in vendor review, with documented review of biometric handling and disclosure paths.
Bottom line: The central issue is not age verification itself, but whether privacy claims about biometric processing can be verified against live system behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 11:25 pm
Evidence, not assertion, is the real control plane in identity privacy disputes: when a service handles facial images, the governing question is whether the data path can be independently proven. Claims about deletion, non-sharing, and internal-only processing only become useful when they are backed by audit trails, architecture review, and reproducible testing. Practitioners should treat privacy assurance as an evidence discipline, not a messaging exercise.
A question worth separating out:
Q: Should organisations rely on certifications alone for age assurance assurance?
A: No. Certifications improve baseline confidence, but they do not answer a specific question about how one biometric workflow handles live user data. Organisations should use certifications as supporting evidence and still require direct proof of the processing model, especially when facial images are involved.
👉 Read our full editorial: Yoti dispute shows age verification privacy claims need stronger evidence