Notifications
Clear all
Topic starter
30/07/2026 11:21 pm
TL;DR: The UK’s updated alcohol licensing rules will allow tens of millions of adults to prove age digitally, while the article argues that privacy-preserving identity flows still depend on strong biometric assurance for account recovery and critical events, according to Yoti. The deeper issue is that consent-based alternatives can weaken identity assurance when they remove the control model that protects verified accounts.
NHIMG editorial — based on content published by Yoti: digital proof of age, privacy-preserving identity, and biometric alternatives
By the numbers:
- About 30% of the UK’s 5.5 million 18-25 year olds have a Yoti ID (or EasyID).
- Anyone over 18, up to 57 million people, with a certified age credential can choose to prove age digitally for alcohol purchases.
- By design, Yoti has no idea which individual out of the current 8.4 million UK Yoti app users may be using Yoti to prove they’re over 18.
Questions worth separating out
Q: How should organisations implement age verification without over-collecting personal data?
A: Use the minimum attribute needed for the access decision, then prove age through a trusted credential or wallet flow that does not expose the full identity record.
Q: When do biometric alternatives create more risk than they reduce?
A: They create more risk when they weaken the recovery or account-change boundary while leaving the same level of access in place.
Q: How can security teams decide whether a digital identity flow is high assurance enough?
A: Judge it by the strength of the binding between the credential, the device, and the account recovery path.
Practitioner guidance
- Define the high-risk identity events Separate ordinary authentication from events such as document enrolment, PIN change, account recovery, and account deletion.
- Document your privacy-preserving disclosure model Specify which attributes are disclosed at the point of verification, who can see them, and what data never leaves the user device.
- Test recovery paths against takeover scenarios Review whether a compromised phone, stolen session, or weakened recovery factor could let an impostor pass the control boundary.
What's in the full article
Yoti's full blog post covers the operational detail this post intentionally leaves for the source:
- How the UK alcohol law change affects digital proof of age adoption across licensed premises and retail flows
- The Tap-Selfie-Scan and Tap-Selfie-Tap interaction patterns, including how the wallet and verifier apps work together
- The article's own explanation of why biometric alternatives are difficult to offer at equivalent cost and assurance
- Yoti's position on interoperability between certified digital ID issuers and why it matters for ecosystem adoption
👉 Read Yoti's analysis of digital proof of age and biometric alternatives →
Digital proof of age and biometric alternatives: what changes for IAM teams?
Explore further
30/07/2026 11:24 pm
Biometric alternatives are not a universal substitute for assurance. The article makes the case that some private-sector identity journeys cannot offer equivalent security, convenience, and cost without biometric authentication. That is a governance boundary, not a UX preference. When the event is account recovery or a security change, the question is whether the alternative preserves the same level of identity certainty. Practitioners should treat this as a control equivalence problem, not an accessibility slogan.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why control design must assume incomplete inventory first, not perfect discovery.
A question worth separating out:
Q: Who is accountable when biometric identity verification fails?
A: Accountability sits with the organisation that selected the control, accepted the risk, and deployed the verification flow into a regulated environment. In APAC, that usually means security, IAM, privacy, and compliance leaders share responsibility for evidence, governance, and vendor oversight. If the architecture cannot support audit and traceability, the accountability gap becomes operational.
👉 Read our full editorial: Digital proof of age and biometric alternatives in identity verification
