**Yoti Age Verification Software: Privacy Issues and Data Practices**
Yoti, a prominent age verification solution utilized by roughly 60 percent of websites and services that require age checks—including prominent platforms such as PlayStation, Meta, and TikTok—has faced criticism for its data collection methods. A new analysis from the Georgia Institute of Technology and the University of California raises concerns about the volume of personal information Yoti collects, exceeding what is necessary for age verification and its ramifications for user privacy.
The analysis, named “Papers, Please: A First Look at Age Verification on the Web,” was shared at the IEEE Symposium on Security and Privacy conference on May 18, stressing that Yoti’s practices could endanger user privacy while questioning the efficacy of its age verification process. The findings indicate that Yoti gathers a significant amount of high-resolution data about the user’s device during the verification procedure—data considered unnecessary for determining a user’s age. This encompasses detailed information, such as operating system version strings, available RAM, connection type, and CPU architecture. Such data can facilitate unauthorized tracking of users’ devices, raising considerable privacy issues.
One of the most concerning points raised in the analysis is Yoti’s partnership with various opaque fourth parties, including payment processor Stripe. The research mentions that Stripe collects considerable telemetry which could potentially enable unique identification of a device. The data shared with these third parties, according to the study, extends beyond age verification requirements, including high-entropy browser and device metadata, in addition to other granular telemetry that could threaten user privacy.
Following the release of the report, the researchers noted that Yoti has asserted it is addressing the matter concerning Stripe’s access to the first-party website. However, they were unable to independently confirm the accuracy of this claim. This situation brings up further inquiries regarding the security of user data managed by Yoti and the credibility of the safeguards established to protect that information.
The characterization of the issue as a “bug” by Yoti does little to build trust in the system, raising worries about how securely user-provided data is handled and whether any information shared with Stripe has been retained.
As age verification becomes more essential for online services—aiming to shield minors from inappropriate content—grasping the privacy implications of the technologies used in such processes is crucial. The increasing overlap of age verification and user privacy highlights the necessity for transparency and accountability from entities like Yoti, as they confront the challenges of ensuring safe, effective age checks without undermining user data security.
