Yoti Profile Picture

Yoti

In response to the ICO’s opinion on Age Assurance for the Children’s Code

In response to the ICO’s opinion on Age Assurance for the Children’s Code

The Age Appropriate Design Code is a statutory data protection code of practice from the ICO that applies to providers of Information Society Services that are likely to be accessed by children, such as apps, online games, and web and social media sites. The ICO released an Opinion that looks at how age assurance can form part of an appropriate and proportionate approach to reducing or eliminating risks and conforming to the code. This included opinions on age verification and age estimation technologies. We believe that some of the generalisations made about age estimation do not apply to Yoti’s privacy preserving facial age estimation solution. Please read on for more.   Introduction to Age Estimation Yoti’s Age Estimation using facial images is a secure age-checking service that can estimate a person’s age by looking at their face. We consider it to have wide application in the provision of any age-restricted goods and services, both online and in person. Businesses have already used our service to perform over 500 million age checks since launch of the service two and a half years ago and a growing number of businesses are adopting our solution. Yoti’s Age Estimation using facial images is designed with user privacy and data minimisation in mind. It does not require users to register with us, nor to provide any documentary evidence of their identity. It neither retains any information about users, nor any images of them. The images are not stored, not re-shared, not re-used and not sold on. The images are not used to train the model further. It simply estimates their age and then deletes the image. Yoti’s Age Estimation using facial images does not create or use biometric facial geometry. The model only looks at a photo of a person. For a detailed explanation of how it works, how it was trained and its accuracy please see our White Paper.   How it works Yoti’s Age Estimation using facial images model is a neural network model trained using machine learning techniques – in other words it is an algorithm trained on lots of data to give an estimated age. A face image is inputted into the algorithm and then based on the images it has been trained on the algorithm is able to output an estimated age. Because the only data we used to train the algorithm are face images with the person’s age in months and years, the model cannot work out anything else other than an estimated age. All the model knows how to do is to estimate age. The model does not know how to identify someone, how to face match or even tell if the same person’s image is repeatedly submitted to it. If you kept submitting slightly different photos of yourself to the model, it would come out with slightly different estimated ages. Things like lighting, camera quality and angle of the face change the outputted estimated age. The key point is that the model cannot say to itself: “I have seen this face before and I can use that information to estimate the age on this image.”   The legal position of Yoti’s Facial Age Estimation  Yoti’s facial age estimation complies with the UK GDPR and also our own ethical approach to user data and privacy. When businesses use age estimation to verify the age of their customers Yoti acts as the data processor, with businesses as the data controllers. Businesses therefore need a legal basis to use age estimation. The model obviously processes personal data (a face image) so the legal basis for processing personal data relied upon by businesses will be either: (i) consent of the customer; (ii) performance of a contract between the business and the customer; or (iii) legitimate interests of the business that do not unfairly prejudice the customer. The Yoti Age Portal has a consent option in-built so businesses can easily collect consent from customers for use of Yoti’s Age Estimation if that is the lawful basis the business chooses. If Age Estimation processes biometric data and if Age Estimation processes ‘special category data’ then the business will also need to process under a legal basis in Schedule 1 of the UK GDPR, such as consent or acting to protect children. However, Yoti’s facial age estimation does not involve the processing of biometric data or special category data. This is because the facial age estimation model is physically unable to allow or confirm the unique identification of a person (and that is the key test for biometric data) and it is not being used for the purpose of identification (and that is the key test for special category data). The model was not trained to recognise a face, but instead to categorise that face into an age. In our view, and in the view of our external lawyers, Yoti’s Facial Age Estimation does not identify a user because the only possible output is the non-identifying estimated age. Further, even if the view is taken that it is biometric data, it is not ‘special category data’ because there is the added test of needing to use the model for the purpose of uniquely identifying a person – and the model is used explicitly not to identify a person, but instead to allow a person to age verify themselves without being identified.   Definitions of biometrics in GDPR For those more legally minded, here are some of the key parts of the UK GDPR. Definition of biometric data in Article 4(14) of the UK GDPR: Personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data.   Definition of special category data in Article 9 of the UK GDPR: Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.   Recital 51 of the UK GDPR further says that: The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.    What the ICO has said In the Commissioner’s [the ICO’s] Opinion on Age Assurance for the Children’s Code, first published on 14 October 2021, the ICO states that age estimation “may” involve the processing of biometric data (at para 2.3.2) and then clarifies later at para 4.2.1 that it is only biometric data if it is used to uniquely identify an individual. Yoti cautiously welcomes the Opinion because of its generally clear explanation to organisations on how to apply age assurance for the Age Appropriate Design Code. But the Opinion does not clearly explain when age estimation uses biometrics, and just as importantly, the Opinion does not explain when age estimation using facial analysis does not use biometric processing and is not special category data. This would have been very helpful for organisations seeking to implement the age assurance measures required under the Age Appropriate Design Code. Further, the ICO at para 4.2.1 could have also made clear that it is not processing special category data if the purpose of the processing is not to identify someone. This would also have been helpful clarity to those evaluating different age assurance methods. The ICO has helpfully clarified that processing biometric data for the purposes of the Age Appropriate Design Code can be lawfully done to meet the ‘substantial public interest’ exception in the UK GDPR (Article 9(2)(g)). Yoti’s implementation of facial age estimation (immediate deletion of the image, use of very secure data centres, SOC2 Type 2 security certification, use of encryption in transit and only returning to the business an estimated age result) means that businesses can be assured that the remainder of the Article 9(2)(g) requirements are met.   Accuracy of our Facial Age Estimation The Yoti White Paper discloses how accurate the model is. The testing is split by age, gender and skin tones to reassure organisations and the public that there is minimal, if any, bias in the model for the key 18+ metric. We have been publishing our accuracy every few months for the last two and a half years. The ACCS, an independent testing company, assessed the model and published its certification report for Yoti Age Estimation in November 2020 which concluded that: “The System is fit for deployment in a Challenge 25 policy area and is at least 98.89% reliable“. We shared this certification evidence with the ICO in November 2020. We strongly disagree with the ICO’s statement in Annex 2 of its Guidance which groups all age estimation techniques together and then provides a grouped statement on their accuracy: “Age estimation techniques generally use Artificial Intelligence (AI) algorithms to automate the interpretation of data. There is little evidence for the effectiveness and accuracy of these emerging approaches.” We understand that currently there are a limited number of businesses offering accurate age estimation, but there is clearly strong evidence that for the last 12 months there is compelling evidence that Yoti’s age estimation AI service can reliably estimate the age of adults to meet the needs of retailers and online brands wishing to prevent under 18s from buying age restricted goods or accessing over 18 content.

8 min read
Online age verification: a new era

Online age verification: a new era

For years, businesses delivering age-restricted services online have gotten away with hiding behind a tick box. But it seems that governments are waking up to the dangers caused by exposing minors to age-restricted content. New legislation is starting to enforce more stringent online age verification for social media , dating, gaming and adult content sites. But what does this mean for the operators of those sites? How do they verify a user’s age without adding friction to their carefully crafted user experience? In a world where 40% of users are said to abandon a website if it takes more than 3 seconds to load, how do you stay competitive and protect your users with proper age-gating?   How have businesses done online age verification in the past? The Age Verification Providers Association (AVPA) said it best: “Age verification requires more than just checking a box or even typing in your date of birth to claim you are old enough to access an online service.” And up until recently, these methods of online age verification were standard practice. Then, credit card verification and electoral roll checks came along to add an extra layer of assurance for businesses.  However, these checks were still easy to bypass. Children could still access content that is considered harmful – and adults were still able to enter spaces designed for children. There was a clear need for change and more sophisticated technology.   New ways to age gate your website The most common way businesses digitally age check their customers nowadays is by asking them to upload an ID document and capture a selfie. Optical character recognition (OCR) is used to extract the data and face match technology matches their real-time selfie with their document photo. More advanced providers can offer a higher level of age assurance with Near Field Communication (NFC) technology. This instantly verifies an ePassport to the same high level as in the airport. The biggest breakthrough in age tech, though, is facial age estimation. This determines a person’s age by analysing their face from a live or uploaded image. It uses a combination of artificial intelligence and machine learning. This is one of the only methods that doesn’t require you to have a document to hand, like a passport or credit card. And, it’s also completely anonymous. Learn more about how we have helped Instagram provide new ways to verify age.   Personalised age checks At Yoti, we’ve developed an array of sophisticated methods that let businesses gain the right level of assurance that someone is the appropriate age to be accessing your services, which varies across industries. Being able to customise the way they do online age verification ensures they are hitting the right sweet spot between assurance and friction. This could range from an estimated age based on a real-time selfie or a verified date-of-birth from an ID document. Once the age check is complete, we share an Over or Under age and delete all data captured during the process. Whether your priority is speed, age assurance or accessibility, you can pick and choose the tools that work best for you and your users.   Age assurance tools Facial age estimation: Your users just have to look at the camera on their device and take a selfie. Our world-class technology will calculate an estimated age based on facial features within a year or two accuracy. Yoti app: With over 10 million Yoti app downloads, you could make the most of the existing network of users that have already verified their age with us by uploading their ID document. They just scan a QR code on your website and prove they’re over your age threshold using their phone.  ID verification: Your users can prove their age by scanning their ID documents and taking a biometric selfie on their device. We use leading AI and NFC technology to verify the user and their ID document, with our identity experts on standby for when your users take scans or selfies that need a trained human eye. For example, if they take a selfie in a dark room.  Credit card check: You users input their credit card details, and we do an active card check to make sure it’s valid. Database check: We verify your users’ name, date of birth and address against a database. Mobile provider check: We verify your customer is over 18 using their mobile provider details.   Why we designed it that way One of our seven ethical principles is to enable privacy and anonymity, so being GDPR-aligned is as important to us as it is to you and your business. We built our age verification with Privacy by Design to empower your users to keep their data safe and private. We also limit the amount of data your users need to share with you and with us. And the individual data we do have – such as date of birth or full name – is securely encrypted and held separately. Once we share with you whether your users are over or under your threshold, we instantly delete their data. This way, your users can prove their age whilst remaining entirely anonymous. When their age is shared, you will only know if they pass the threshold you have set out. For example, if you only want over 18s to access your site, that’s all you’ll know when users complete an age check. We also only use first-party cookies when helping people prove their age. This way, businesses can be confident that they can verify their users’ age without invasive privacy practices.   Future-proof your business against new legislation As digital spaces develop, online businesses will need to have measures in place to protect themselves from legislation that could impact their operations. A UK Government white paper published in 2020 called for companies to start developing and sharing technological solutions to help protect children from online harms, rather than complying with minimum requirements. So, over the next few years, we expect a number of legal frameworks will disrupt online services that are used by children. The newest set of standards have been set out by the ICO in the Age Appropriate Design Code (the Code), which came into effect on 2nd September 2021. It is one legal framework that aims to create a safe digital space for children. We are working hard to ensure that we comply with the Code, but also we want to encourage other companies to start taking measures to help protect the children who use their services.  The International Organization of Standardization (ISO) is also drafting their own Age Assurance Systems Standards, so no matter where you do business, it may be time to age-gate certain parts of your website. In any case, we want to empower you to do the safest thing for your users, especially children. If you would like to learn more about how your business can benefit from the newest age verification technology, get in touch with us today.

6 min read
Big first steps for Post Office EasyID and Yoti creating the UK’s trusted identity network

Big first steps for Post Office EasyID and Yoti creating the UK’s trusted identity network

It’s only been a month or so since the Post Office EasyID joined the Yoti ID app here in the UK and we’re delighted to share the progress we’ve made on our mission to build the UK’s trusted identity network.  Over 85,000 people downloaded the Yoti or EasyID app to join our UK network in September alone, a positive indicator that many people want to take control of their data and protect their privacy with a safer way to prove who they are. Together we make it easier and safer for people to prove their identity and help businesses know who they’re dealing with. On average, you’re never more than a mile from a Post Office and you can now share your Yoti or EasyID in 10,500 branches across the country for collecting mail or buying a lottery ticket. Watch this space for more great ways to use your digital ID in your local Post Office branch. We’ve also added over 20,000 convenience stores to the list of places that accept Yoti and now EasyID, which means there are over 31,000 UK high street locations to share your digital ID and this number continues to grow.  We are excited to be starting our supermarket self checkout age verification trials and to see many more businesses joining the network over the coming weeks and months. If you haven’t already, it’s time to join the digital identity revolution! 

2 min read
Introducing the Post Office PASS card: the affordable way to prove your age

Introducing the Post Office PASS card: the affordable way to prove your age

People need cheaper, safer ways to prove who they are. Shockingly, 93 per cent of 16-34-year-olds take their important ID documents out with them every day, with only a minority keeping them safe and sound at home. It’s not convenient or safe to carry your passport or driving licence every day just to prove your age, so why do they do it?  Well, it’s because they often need to prove their age to do everyday tasks, like buying an energy drink or going to the cinema. With that comes a greater risk of damaged, lost or stolen ID documents.  Furthermore, over 11 million people in the UK don’t have a passport or driving licence, and the cost of getting one certainly can act as a deterrent, especially if they have no intent to travel overseas or drive.  Everyone needs simpler, cheaper ways to prove their age, which is why Yoti launched the Yoti CitizenCard back in 2018 and now we are pleased to announce that our partners at Post Office are launching the new Post Office PASS card.   Stop risking your important ID just to prove your age In the UK, over 1 million driving licences and 400,000 passports are lost, damaged or stolen each year. It’s much safer to leave these important documents at home, whether that’s to make sure you’re not paying £100 for an emergency passport for your holiday to Spain or not having your driving licence to hand when you need to hire a car. There is also the risk that because there is more personal information presented on your passport or driving licence that fraudsters could use your details to compromise your identity.   What are PASS cards? Passports are for travelling, and driving licences are for driving. PASS cards are for proving your age. It currently costs £34 to get a provisional driving licence and £75.50 for a passport. The Post Office PASS card and Yoti CitzenCards cost just £15. PASS cards are official UK proof of age cards that display your photo, name and date of birth. You can use them to prove how old you are to most UK retailers, businesses and government-run institutions. The Yoti CitizenCard and Post Office PASS card are issued by CitizenCard and are government-approved proof of age cards that display a Home Office-endorsed PASS (Proof of Age Standards Scheme) hologram and UV mark. That’s how you know they are genuine. Both the Yoti CitizenCard and Post Office PASS card also have a QR code on the back that you can scan to further verify the card’s authenticity. At just £15, we believe that the Post Office PASS card and Yoti CitizenCard are affordable and accessible ways for people in the UK to prove their age and identity.    Why should you get a PASS card?  Suppose you are looking for a cheaper alternative to prove your age or simply don’t want the pressure and risk of taking your important documents out with you, a PASS card is a great option for you.   Affordable: At £15, a PASS card costs less than other forms of physical photo ID and isn’t too expensive to renew if you lose it – it’s only £12 for a renewal.  Fast: You can get your PASS card within 3 weeks. You can also choose the fast-track delivery option to receive it 1-2 days after verification.  Private: You don’t need to show all your details when proving your age to businesses. PASS cards contain less sensitive data than a driving licence or passport with just your name, photo and DOB.  Recognised: The National Proof Of Age Standards Scheme (PASS) scheme is endorsed by the Home Office, Scottish Government, National Police Chiefs’ Council (NPCC) and the Security Industry Authority (SIA).   You can use your PASS card to prove your age when: Going to nightclubs, bars and pubs and festivals Starting a new job to prove who you are Accessing housing services or claiming benefits Playing the lottery or buying scratchcards Renting a new home Visiting prisons Purchasing videos (DVDs or Blu-Ray discs) and computer games Applying for a UK driving licence Travelling on domestic flights within the Common Travel Area (England, Scotland, Wales, Northern Ireland, Republic of Ireland, Channel Islands, Isle of Man). Making any other age-restricted entry or purchase, such as buying energy drinks, alcohol or cigarettes, access to 15 & 18 movies in the cinema   Double your options with EasyID and Yoti You’re hardly ever without your phone. Once you have your PASS card, you can add it to your Post Office EasyID or Yoti app to prove your identity both online and in person. Just scan the front of your PASS card into your EasyID or Yoti app to create a reusable digital ID on your phone. The next time you need to quickly show your ID to buy a lottery ticket, pick up a parcel or apply for a job, you can use the app to share the information you need in person or online. If you haven’t already, download the Post Office EasyID or Yoti app from your app store. Find out here how you can easily create your digital ID.   Get a PASS card for a simpler way to prove your identity Everyone should be able to prove their age when they need to. Whether you’re a parent worrying about your child taking their passport to the cinema, someone who doesn’t want to lose their ID when popping to the shops, or you’re simply looking for a more affordable way to prove who you are, a PASS card is an invaluable card to have in your wallet or purse. If you’d like to read more about the Post Office PASS card and find out how to apply please visit https://www.postoffice.co.uk/identity/pass-card 

5 min read
Swotties uses Yoti digital ID to verify the identity of online tutors

Swotties uses Yoti digital ID to verify the identity of online tutors

Yoti has partnered with Swotties to make sure that children can access safe and secure online tutoring.   Swotties: connecting families with inspiring university students Swotties is an online tutoring platform on a mission to provide more affordable and accessible tutoring services for families in the UK. They connect children and parents with university students who can offer expert help in their chosen subject. They also run a give-back scheme where, for every 20 lessons booked by one household, they donate a lesson to an underprivileged child. Providing 1-2-1 online learning sessions is part of Swotties mission to boost the confidence of school children across all levels and subjects. A fundamental part of this service is giving parents the assurance that their children are in safe hands during these sessions. That’s why Swotties has partnered with us, ensuring a trusted, safe and quality tutoring service.    Verifying users with Yoti Students who want to become a Swottie can prove their identity the Yoti or EasyID apps by simply uploading a government-issued ID document and taking a biometric selfie. Once they are verified, students can then progress to the selection and approval process as set out by Swotties. Parents can rest assured that every tutor’s profile is verified and approved before it goes live.   Make user onboarding easy With no complicated integration, Swotties is able to move prospective tutors along the application process quickly and efficiently. By ditching manual identity checks, the amount of time students spend waiting for their profile to be approved is reduced and parents are reassured that their children are in safe hands. The simplicity, speed and ease of being able to prove your identity digitally is becoming increasingly important amongst teenagers and young adults. With over 10 million app downloads, Swotties is able to tap into the existing network of UK students already using the Yoti and EasyID apps. Trusted by millions, it has never been easier to securely verify the identity of your users and customers. To learn more about how Swotties works, check out their FAQs. If you’re looking to make identity verification simpler for your business, contact us here, or fill out the form below – we’d love to hear from you. Get in touch to hear more If you're interested in this partnership, we'd love to hear from you. Fill your information in the form and we'll get back to you within one business day.

3 min read
Launching Post Office EasyID: a smarter way to prove who you are in store and online

Launching Post Office EasyID: a smarter way to prove who you are in store and online

We are delighted to announce the launch of the new Post Office EasyID app. As the name suggests, it’s your ID made easy and puts your valuable personal data on your phone and under your control. It’s free, smarter than your regular ID and lets you conveniently prove your identity in person and online, with just a tap or scan of a QR code.  Following in the footsteps of digital money, we believe it’s time for Digital ID to shine and become your next phone essential. Particularly in the era where services continue to migrate online and contactless following the coronavirus pandemic. This digital transformation calls for a smarter, safer and easier way to prove who you are. That’s why Yoti and Post Office are working together to deliver EasyID.   What makes EasyID, easy? Long gone are the days of needing your passport or driving license just to buy a lottery ticket or pick up a parcel. EasyID lets you prove who you are on your phone, so you can leave your important documents safe at home. What makes it easier than using your physical ID documents? Fast: Your EasyID is a smarter ID that can be shown quickly and easily to staff in-store or with businesses online. Convenient: You no longer have to search for ID documents to do tasks that should be simple, like collecting a parcel. All of your identity details are now all in one place on your phone. Reusable: Once you have created your EasyID account and verified your identity, you can use it to prove who you are to all participating businesses. Safe: All of the details added to your digital ID are encrypted to securely store your data on your phone. Only you have the key to unlock your encrypted details, protecting you against identity fraud. Data-minimised: Share less data with businesses and only show what’s important. For example, show just your age to purchase age-restricted goods or just your full name to collect a parcel.    EasyID is accepted at over 25,000 locations across the UK Whether you’re one of the millions of people collecting a parcel from one of the 10,500 Post Office branches or buying lottery tickets from your local convenience store, you can use your EasyID. In fact, over 90% of the UK population live within a mile of a place where you can use your EasyID. Simply lookout for the EasyID or Yoti stickers in Post Offices, Payzone locations and many other convenience stores. Wherever the Yoti ID app is already accepted, you’ll be able to use EasyID – with many digital-first businesses including dating sites, estate agencies and social networks on the growing list. For the full list of participating sites and locations, click here.   It’s simple: set up your EasyID in minutes Add your phone number and create a 5 digit PIN to secure your account Use your phone camera to take a selfie so we can verify you Scan a government-issued ID to add your personal details to your EasyID   Building the UKs trusted identity network Yoti and Post Office partnered earlier this year to drive digital transformation in the UK. EasyID is the first of many products and services we’ll introduce that use the latest technology to help individuals, Postmasters and businesses unite against identity fraud – online and in person. EasyID is built on our shared principles of data minimisation and privacy to help businesses and individuals connect more securely, with added confidence that people are genuine. This builds trust and makes it more efficient to get things done. Everyone wins. It takes just hours for businesses to integrate into our secure identity network, bringing instant access to the millions of people that share our belief in digital identities. Whether you’re a small local or national scale business, we have the right solutions for you. Yoti and Post Office gives you access to the only identity network that covers the whole UK, online and in person with 11,500 branches.   Nick Read, Chief Executive at the Post Office, said:  “Our free-to-use Post Office EasyID app is all about making life a little bit easier for the millions of people who use our branches to collect their parcels and other mail. Having the app means you don’t need to show a physical copy of your driving licence or passport to prove your identity, meaning a quicker and safer experience in a branch.      “The app allows customers to build their own secure digital identity on their smartphone, enabling them to easily control and prove who they are to whichever business they want to interact with. We see this as an exciting opportunity for customers and postmasters alike and expect the app to become a standard way of verifying ID for many businesses nationwide. “For Postmasters, the app brings a range of particular advantages. As well as making the collection process faster, it will encourage people to choose delivery to Post Offices and help drive footfall. In addition, the app can be used for proof of age in Post Offices and shops, to buy age-restricted items including lottery tickets and medicines.”   Yoti CEO, Robin Tombs, said: “We’re delighted to launch Post Office’s EasyID across the UK and make proving identities safer for consumers and businesses alike. The journey to a world where everyone can be universally recognised is underway – good timing too with rates of fraud on the increase and more of our lives spent connecting with digital services and online.  “Far too many people find it hard – or even impossible – to prove who they are. The lack of correct documentation, fear of fraud, struggles with digital processes, and frustration with the time it might take has held people back from being recognised, running the risk of them being left behind. Technology, however, is an enabler, and the UK, with its culture of digital adoption, has the potential to lead the world on this.  “There are already thousands of businesses accepting our digital identities, and together with the Post Office, we are a step closer to becoming the UK’s trusted identity network, building transparency and trust amongst consumers and making a positive difference to society.” Make the most out of the Yoti digital identity network today. For more information about EasyID, read more here.

6 min read