Topic starter
02/08/2026 11:59 am
TL;DR: Independent testing published by NIST shows facial age estimation models vary sharply in accuracy, robustness and fairness, while Yoti says its top model recorded a 2.14-year mean absolute error and held up across changing conditions. The bigger issue is that age assurance only works when performance, privacy and verification steps are independently measurable, not assumed.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “Thoughts from our CEO: Building credibility with independent testing of facial age estimation”.
Key questions
Q: What breaks when facial age estimation is used without liveness checks?
A: The control becomes vulnerable to replay and impersonation attacks.
Q: Why do age assurance failures create regulatory and accountability risk?
A: Because age assurance is used to make access decisions that affect children, consumers and regulated transactions.
Q: How should organisations use digital ID wallets for age assurance without over-collecting data?
A: Treat age assurance as a minimal-evidence decision.
Practitioner guidance
- Define measurable age-assurance acceptance criteria Set thresholds for accuracy, robustness, reliability and fairness before any age estimation tool is approved for production use.
- Separate age proof from identity disclosure Use wallet flows that share only the age credential needed for the transaction and avoid transferring facial images to the verifier.
- Test the full verification journey Validate the device unlock, liveness check, credential presentation and point-of-sale scan as one control path, not as isolated features.
Bottom line: Facial age estimation is only as strong as the evidence behind it, and independent testing exposes the gap between claimed and actual performance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:06 pm
Independent testing is now the governance baseline for age assurance. The article is right to frame accuracy, robustness, reliability and fairness as measurable properties rather than vendor assurances. In identity programmes, controls that affect access decisions must be independently testable if they are to be trusted at scale. Practitioners should treat this as a verification governance issue, not just a product selection exercise.
A few things that frame the scale:
- Gartner predicts that by 2026, 30% of enterprises will consider identity verification solutions unreliable in isolation because of AI-driven attacks.
A question worth separating out:
Q: When is a manual face-match step still justified in age verification?
A: Only when the workflow cannot achieve acceptable assurance through a credentialed, device-bound flow and the business risk justifies the friction. Manual review should be the exception, not the default, because it adds delay, increases human error and can reveal more personal data than necessary. The safest model is to reserve it for edge cases with clear escalation rules.
👉 Read our full editorial: Independent age assurance testing raises the bar for digital ID