A new report from researchers at Georgia Tech and UC Berkeley alleges that Yoti’s age verification software collects excessive user data and shares sensitive information with third-party services.

Key Points

• Researchers presented the study, "Papers, Please: A First Look at Age Verification on the Web," at the IEEE Symposium on Security and Privacy on May 18.
• Yoti software reportedly gathers unnecessary device metadata, including OS versions, RAM, connection types, and CPU architecture, which could enable unauthorized user tracking.
• The report identifies that Yoti shared sensitive telemetry with the payment processor Stripe, potentially allowing for the identification of users across different websites.
• Yoti claims to have resolved the issue regarding Stripe’s access to first-party website data, though researchers have not independently verified the effectiveness of this fix.
• Yoti’s age verification tools are currently utilized by major platforms including Meta, TikTok, and PlayStation to confirm user age.

Why it Matters

This report raises significant privacy concerns regarding the data collection practices of identity verification services used by millions of internet users. It highlights the potential for third-party tracking and the risks associated with sharing granular device telemetry during standard security checks.