You may have noticed that some sites started requiring more rigorous age verification. A simple click on the “Yes, I’m over 18” button isn’t enough anymore — you’re suddenly redirected to a service called Yoti, and it’s asking you for a selfie.
Don’t be alarmed; Yoti is a legitimate company that provides age check services to a growing number of popular sites. It uses a variety of methods to estimate or verify your age and then relays the result to the site, without the site getting hold of potentially sensitive information like your face or ID. In this article, we explain how Yoti estimates your age, discuss the exact methods it uses, and go over the measures it takes to protect your data.
What Is Yoti?
Yoti is a UK-based company, founded in 2014, that offers services related to digital identity, including identity verification, digital ID, digital signatures, and a variety of age assurance methods.
Since mid-2025, use of its services has become more widespread as more countries and territories have passed strict regulations regarding age verification on the internet. Many websites, such as social networks, streaming platforms, or online storefronts, use Yoti’s age checks to comply with these regulations.
Yoti’s age verification service lets sites and online platforms confirm their users’ age without directly collecting potentially sensitive information. It analyzes the information you submit to estimate or calculate your age, and then it tells the site that you’re under or above a certain age (typically 18). The exact information it analyzes depends on the age check method the specific site chooses.
How Does Yoti Verify Your Age?
Yoti offers a variety of age verification methods, but all of them follow the same principle:
- You visit a site that uses Yoti’s age verification.
- The site redirects you to Yoti, which then prompts you to provide relevant information, depending on the verification method used.
- You provide the information to Yoti — not the site you’re visiting.
- Yoti checks the information and relays the results to the site.
- The site then allows or restricts access, based on the result.
Sites using Yoti’s verification services can choose whether they get your exact age or just a confirmation that you’re above or under a particular threshold. They can also require a stricter “liveness check” as an extra precaution. For example, they can ask you to take a selfie and provide your ID (to match the face to the ID photo) or take multiple photos from different angles.
Once you complete age verification with Yoti, it can store the “proof” in several ways, so you might not have to repeat the process on every site that asks for verification. It has a Digital ID app that can verify your age using one of Yoti’s typical methods. When a site asks for age verification, you can use the app to scan a QR code and share confirmation from the app.
Alternatively, you can have Yoti create a passkey on your device (called a Yoti Key), which securely stores an encrypted proof that you have completed the verification. When you visit a site that allows age tokens, it asks you to verify your age. If you have a valid age token as a Yoti Key on your device, Yoti checks it and then sends a confirmation to the site that you passed the age check.
Yoti’s Age Verification Methods
Facial Age Estimation
Involves the user taking and uploading a selfie to Yoti. Its system analyzes your facial features and compares them with typical parameters for different age categories. Yoti explains that the process doesn’t involve facial recognition.1 It also claims to delete the selfie once its systems give an estimate and not to share it with the site you’re visiting or other third parties.
Document-Based Verification
Uses an identity document to determine your age. You take a photo of your ID and upload it. Yoti’s system extracts your date of birth from the image and calculates whether you’re above the site’s age limit or not. Afterwards, it deletes the extracted data and photos.
Credit Card Check
Infers your age through an active credit card. The reasoning behind this method is that credit card holders are above 18 years of age. You enter your card details with Stripe (a payment provider partnered with Yoti), which checks if the card is active and valid. It places a temporary hold on a small amount of money and removes it as soon as the check is complete. The platform doesn’t charge you and money never leaves your account.
Mobile Provider Check
Uses the information your mobile carrier has to check your age. You provide details including your name, date of birth, and mobile number. Yoti forwards these details to a third-party mobile checking partner, who confirms they match the mobile phone contract or profile. You might receive an SMS with a verification code to confirm you physically possess the phone.
Email Address Check
Infers your age through a provided email address. Yoti looks at an email account’s details, such as age of creation, associated accounts, and whether it’s attached to an organization like an employer or an educational institution. It can also share the provided address with a third-party organization that checks the address against fraud insight or marketing databases.
Other Forms of Age Verification
Yoti can use different documentation or information specific to certain countries. For example, it can check the LA Wallet mobile driver’s identification for Louisiana, US; the CPF (Cadastro de Pessoas Físicas) number for Brazilian residents; or some eID providers in Sweden, Denmark, and Finland.
Which Sites Use Yoti?
While Yoti’s list of clients isn’t publicly available, some online services and platforms that use its services include:
- Social networks: Increasingly required to have stronger protections for minors. Social media platforms like Facebook,2 Instagram,3 and Bluesky4 have implemented Yoti’s services, such as facial analysis for age assurance.
- Gaming platforms: Often have features like user-generated content, messaging, or voice chat between users, which can expose minors to cyberbullying or similar risks. Platforms like PlayStation,5 Xbox,6 and Epic Games7 have introduced Yoti age verification in some regions like the UK.
- Adult content: Many adult content platforms use Yoti to comply with strict laws and regulations regarding such content in various locations like France, the UK, or some US states.
- Online storefronts: Some online shopping sites like Shopify8 use Yoti’s services for age-restricted products like alcohol, tobacco, or knives.
How Yoti Handles User Data
In its Age Verification Privacy Policy,9 Yoti claims that the data you submit for most age verification methods is deleted as soon as the check is over. In some cases, it might keep data related to identity document checks for up to 28 days. Yoti keeps age verification results for six months, but its client sites might store the results for a longer time period, depending on their own data policy.
In its Security Notice,10 Yoti outlines in further detail the measures it takes to protect user-submitted data:
- External audits: Undergoes an annual security assessment by a Big Four firm. These companies are considered the industry standard for these kinds of audits.
- Compliance: Complies with UK and German codes of practice and claims to align with the General Data Protection Regulation (GDPR), a rigorous privacy law in the European Union.
- Encryption: Encrypts the collected data to protect it from snoops. Yoti uses strong encryption methods, such as TLS for data in transit, and AES-256 for data on its servers. This is similar to the encryption methods used in secure VPN protocols like OpenVPN.
- Restricted access: Carries out ID verification only in specialized security centers. These centers have rigorous staff vetting processes and strong physical security to strictly regulate who has access to collected data.
However, in March 2026, the Spanish Data Protection Agency (AEPD) fined Yoti €950,000 following an investigation into its practices.11 The AEPD claimed that Yoti was in breach of GDPR on multiple accounts, including unlawfully processing biometric data of children under 13, retaining collected data for too long, and having bad mechanisms for informed consent to data collection.
Should You Use Yoti to Verify Your Age?
Ultimately, it depends on your threshold for trusting a company with potentially sensitive information. Yoti is a generally secure company under frequent scrutiny. It has government-issued certification, and it undergoes audits regularly.
That said, Yoti has come under legal fire for excessive data retention and mishandling children’s data, which is still worth noting. As Yoti sees more widespread usage, more eyes will be on it, so you’ll have an easier time making an informed decision on whether you want to use Yoti’s services.
FAQ
What is Yoti used for?
Yoti offers a variety of services, including age checks, facial age estimation, digital ID, digital signatures, and identity verification. Yoti’s age assurance service lets sites and online platforms check their users’ age. It’s typically used when sites need to limit or completely prohibit access to minors. It doesn’t share the submitted information, such as a selfie or an ID, with the site — it only tells the site your age or age category.
Is Yoti safe to use?
Generally speaking, yes. Yoti’s Security Notice explains how it protects the data you submit, how long it retains the data, and what it shares with whom. For example, when you submit a selfie, Yoti encrypts the data in transit and then deletes the selfie as soon as it’s done estimating your age. However, the platform did face legal consequences after it was accused of not following GDPR practices.
How does Yoti verify your identity?
Yoti offers an identity verification service, and it does so through a valid identity document. You provide a photo of a valid identity document, as well as some form of “liveness check,” like a selfie to match the face to the photo on the ID. This differs from Yoti’s age verification methods, which only infer your age rather than identify you.
Is Yoti free for users?
Yes, Yoti is free for users verifying their age. If you use a credit card check as the verification method, it works with a partnered payment provider to temporarily put a very small hold on your card. This is how Yoti confirms that the card is valid and active. As soon as the check is complete, Yoti undoes the hold and no money ever leaves your account.
What companies use Yoti?
Yoti doesn’t publicly disclose its list of clients. Some sites that use Yoti’s age verification services include social networks like Facebook and Instagram, online gaming platforms like Xbox and PlayStation, and various sites like Shopify, Spotify, and Twitch.
References:
1. Why Yoti’s Facial Age Estimation Isn’t Facial Recognition — Yoti
2. Confirming Your Age on Facebook — Facebook Help Center
3. How Using Your ID to Verify Your Age Works on Instagram — Instagram Help
4. Our Approach to Age Assurance — Bluesky
5. Age Verification Frequently Asked Questions (UK) – PlayStation
6. UK Age Verification on Xbox — Xbox Support
7. Epic Games Parental Consent
8. Yoti Age Checks Now Available for Shopify Stores — Yoti Blog
9. Age Verification Privacy Policy — Yoti
10. Rigorous Internal, Physical & Platform Security — Yoti
11. Spain’s AEPD Fines Yoti $1.1M for Biometric Data Handling Violations — biometricupdate.com
Leave a comment