In this blog series, our CEO Robin Tombs will be sharing his experience, whilst focusing on major themes, news and issues in the world of identity verification and age assurance.
This month, Robin chats about the UK’s supermarket trials, the growing momentum behind digital ID and developments in online safety regulations.
Facial age estimation and Digital ID supermarket trials
Many Yoti followers will know we developed effective facial age estimation at the end of 2018 – over 6 years ago. After several UK supermarkets pleaded for the Home Office to trial the technology at self-checkouts, trials were completed in the first half of 2022.
Across 5 supermarket groups, shoppers chose to complete around 94,000 Yoti facial age estimation age checks and around 4,000 Yoti Digital ID checks. The supermarkets reported that not a single person under 18 wrongly passed a digital age check to buy alcohol.
‘Asking for ID’ is a key trigger for the more than 1,000 daily incidents of verbal abuse (and sometimes physical assaults) reported by retailers. In post-trial feedback, shop staff overwhelmingly supported allowing digital proof of age to improve compliance and staff safety.
Privately, retailers admit that staff in busy stores cannot always spot fake IDs – the alleged ‘gold standard’ traditional approach. However, the Home Office does not permit any formal tests using fake or borrowed genuine IDs. These tests could reveal that some under-18s and young adults are using them.
Whilst the Department for Science, Innovation and Technology (DSIT) has very positively announced that the law will change later in 2025, to allow shoppers to use a certified digital ID wallet to prove their age, supermarkets and other retailers have stressed the importance of giving shoppers the option to also use their face to prove their age in supervised self-checkout areas.
Yoti is currently rolling out this technology in hundreds of retail stores across several countries in Eastern Europe. Shoppers can scan a QR code and have their age estimated on their phone or on a retailer tablet to prove they are adults. We’re investing heavily in providing this service to many businesses outside the UK whilst we (and our competitors) remain blocked in the UK.
The new UK government is championing new technology that can make life easier for individuals. It has expressed that government departments and regulators must consider using innovative technology. This can help effectively meet regulatory goals and boost economic growth.
The Observer recently reported that “One minister describes the Home Office as “the roadblock to reform” and “the place where good ideas go to die”. The article added that an influential insider says, “The prime minister is quite happy to take well-calibrated risk and is pushing ministers and officials to look for the upside of technology.”
The Home Office recently informed age verification providers that the responsibility for digital proof of age now lies with DSIT. We’ve urged Peter Kyle to work quickly with the Home Office to remove this block on science, innovation, and consumer and business choice.
It’s now been nearly four years since the trials proved that facial age estimation can effectively support alcohol sales in supervised self-checkout areas.
If the government wants to encourage more investment in the UK, it must show both businesses and voters that it’s serious about updating regulations. This should happen when new technologies can be as, or more, effective than paper or plastic-based requirements – making life easier.
Protecting against intimate image abuse
While it may have taken longer than many campaigners hoped, laws are finally changing to address more scenarios in which bad actors are complicit in encouraging intimate image abuse.
A recent amendment to the UK Data (Use and Access) Bill makes it clear. Once enacted, it’ll be a criminal offence to ask someone to create a fake intimate image of someone else if that person hasn’t agreed to the request. This is true whether the fake image is actually created or not. The offence applies whether the request is made directly to a specific person, or made publicly (like in a group chat or online). It still applies even if the request is not aimed at anyone specific.
Some individuals may think they won’t be caught when requesting that fake intimate images be created of individuals without their consent. However, it is very difficult to control the retention and inward sharing of digital communications. Potential bad actors should hopefully recognise that it’s not worth risking a criminal record for requesting that a known or unknown other person create non-consensual intimate images, regardless of whether an image is ever created.
For organisations that display intimate images for access by adult viewers, Yoti’s safetytech can help. It ensures that each person shown in an image or video has provided face-authenticated eSign consent.
No consent evidence should mean no mistaken display of intimate images.
Digital ID and identity proofing
It was great to watch Yoti’s Julie Dawson and Andrew Chevis, CEO of CitizenCard (our UK PASS proof of age and identity partner), answer questions from the Department for Science, Innovation and Technology (DSIT) Select Committee on digital ID and physical age/ID cards.
Some important points were made:
- For inclusion, citizens should have a choice. They should be able to use one or more of the following: a UK government-certified digital ID from a private provider, the UK government’s digital ID wallet, a physical government-issued identity document, or a PASS proof of age card when proving their age or identity to organisations.
- Certified digital ID wallets must be accessible. They need to meet the needs of both digitally savvy and less digitally confident citizens.
- At least some digital ID wallets (such as Yoti) will be free for individuals to use. People can use them to store sensitive details and share verified personal identity information. Businesses will pay (relatively small) fees to receive verified credentials, including proof of age and identity.
- Many (but not all) individuals are likely to use a mix of physical identity documents and digital ID wallets. This will depend on what’s convenient for different use cases and which uses are restricted by certain regulations.
- The UK government ID wallet will not offer all the benefits of private digital IDs. For instance, individuals can use facial age estimation in the Yoti Digital ID app and then anonymously share an ‘over 18’ age credential. With the individual’s consent, businesses anywhere in the world can issue credentials through a Yoti Digital ID wallet. This kind of utility is unlikely to be available in the government ID wallet.
- Control and security of personal data stored within, or shared through, digital ID wallets is critical. The UK government will require digital ID wallets to be certified for key use cases, such as right to work, criminal record checks, right to rent and home buying.
- Widespread adoption of certified digital IDs will be very bad news for fraudsters and make life simpler for individuals.
Over the past few years, more than 5.6 million UK individuals have downloaded a Yoti Digital ID. In 3-4 years, around 30 million people in the UK will likely have created one or more of the following: a UK Government ID wallet, a Google or Apple ID wallet, a Yoti Digital ID wallet or another ID wallet (existing or new) marketed in the UK. The impacts will be wide-ranging and far-reaching.
Government commitment to reusable digital ID
Just 48 hours after Peter Kyle and his colleagues presented their vision for how reusable digital ID will evolve in the UK, I sense a growing buzz about the opportunities for the private sector. This approach may also be rather smart for UK society. I think this will be the case as a UK citizen (rather than with my Yoti CEO hat on).
The government’s blueprint says it is committed to requiring government services to issue a digital verified credential in the new government wallet. This will be alongside any paper or card-based credential or proof of entitlement or eligibility by the end of 2027. It opens the door to a world where an array of government-issued documents can be easily stored on your phone, in one place.
I don’t think the enormity of that aim has yet been fully digested.
It may be that not all card and paper credentials will be added to the government wallet by December 2027. However, I sense that Peter Kyle is pretty determined to deliver well – and to deliver fast. Even if only some key credentials are included in the government wallet by then, the impact of this project will be huge.
There are approximately:
- 53 million UK passport holders (all ages)
- 49 million driving licence holders aged 17+ (9 million provisional)
- 55 million National Insurance cards (issued to people 15.75 and over)
- 2.9 million Blue Badge holders
As Natalie Jones OBE stressed, there are many more examples of ‘government cards or bits of paper’ that citizens currently have to keep safe – yet often lose and re-request.
If the UK government gets close to issuing 10-20 of the most highly used government credentials to the UK government digital ID wallet during 2026-2027, I think it’s very likely that 50-70% (28 to 40 million) of UK’s 57 million adults will have a government wallet by the end of 2027. For comparison, around 25 million downloaded the NHS app over 2 years (2021-2022). In New South Wales, Australia, around 75% of drivers added their mobile driving licence in the first two years.
When 20 million (let alone 30 or 40 million) individuals are in the UK’s reusable digital ID network, both the government and businesses will benefit massively. Life will get easier for wallet owners, identity fraud will drop materially and business adoption and utility will explode. This will prompt even more of the remaining adults to get the government wallet.
Additionally, it will encourage many UK citizens to also get a private sector ID wallet. This is because there’ll be much innovation over the next 2-3 years which will enable private ID wallet owners – with derived government credentials, other private sector-issued credentials or payment details – to do many useful things on their phones.
However, a highly adopted government wallet under this ‘model’ will make it difficult for any one or two private sector brands, who gain high network market share, to over-exploit their position. UK citizens could transfer their credentials from the government wallet to businesses, or put a copy of their government credentials into another private sector wallet. Businesses could request credentials from the government wallet or only private wallets under fair pricing models.
I think Peter Kyle is right: now the roadmap is more certain, there’ll be much innovation and an increasingly big boost to economic growth.
This news is not yet well understood and much of the consumer press hasn’t yet covered the issue or drawn out the likely far-reaching impacts.
EU and US regulatory developments on age verification
On 13 May, the EU published its Draft Guidelines on Minor Safety under the Digital Services Act. It contains a list of ‘non-exhaustive’ measures that all online platforms accessible to minors must comply with. This excludes small (<50 staff and <€10m annual revenue) or even smaller micro-enterprises.
Importantly, platforms must implement age verification measures to reduce the risk of children accessing porn, gambling, alcohol or other high-risk, inappropriate content.
The regulatory aim is similar to the UK’s Online Safety Act. It requires platforms to ensure that children cannot normally access online pornography. The EU’s or UK’s age assurance approach doesn’t need to be 100% perfect, but it must be privacy-preserving and secure.
The UK’s regulator, Ofcom, has listed age assurance methods that can be highly effective. These include reusable digital ID, one-time verification using identity documents, facial age estimation (with liveness checks) and credit card checks. Crucially, this leaves the door open for innovative new methods, as long as they deliver effective outcomes in real-world conditions.
The EU has specified which age methods are acceptable for 18+ checks such as:
- EU Digital Identity wallets (EUDIs), when introduced in late 2026
- An interim EU age verification app that’s ‘based on the same tech as the EUDI Wallet’ and does not compromise privacy
Platforms do not have to pay to accept ‘over 18’ proof of age from an EUDI wallet or the EU age verification app.
Globally, facial age estimation is, by far, the most popular, effective and privacy-preserving age check chosen by adults. However, under EU rules, age verification is required to protect minors from high-risk content.
Adults of any age cannot choose to use facial age estimation, regardless of the size of the age buffers applied. For example, a 40-year-old adult cannot (easily) use their face, estimated to be over 25 or 30 in the highly secure, privacy-preserving Yoti Digital ID app, to give confidence that they’re over 18 and subsequently view online porn or buy alcohol.
The EU does say that platforms can use other 18+ age verification methods if they offer an ‘equivalent level’ of verification as the EU age verification app, which provides a high level of privacy, safety and security for minors. So it’s very likely platforms will be able to use, or continue to use, the free Yoti Digital ID wallet, so long as the ‘over 18’ credential has been derived from a date of birth sourced from the person’s identity document.
The EU says effective age estimation (which covers facial age estimation) can be used by platforms that:
- need to enforce their terms of service if they require users to be a minimum age that is lower than 18; or
- where the platform has identified ‘medium’ risks to minors (rather than ‘high’ risks which require age verification).
Across the pond, the US Supreme Court is expected to rule by the end of June whether some age assurance methods, which could include facial age estimation, are sufficiently privacy-preserving and ‘low burden’ enough to be required by state law for accessing online porn.
There’s never a dull month in the age-checking world.
