Data protection and IT security issues with age verification app Yoti

An investigation by security researchers at Mint Secure GmbH shows that one of the leading apps for age verification and age estimation, “Yoti”, tracks users extensively without their consent and therefore likely breaches the General Data Protection Regulation (GDPR). The investigation raises the question of how credible the company’s data protection efforts are, and shows how vulnerable an age estimation tool can be if its training data and supply chain could be manipulated.

This article starts with a brief introduction to age estimation and verification software, then moves on to an examination of Yoti’s website, its Android app, and an analysis of elements of the AI models it uses.

A brief introduction to age estimation and verification software in the EU

In the European Union, age estimation and verification have become a central topic of digital policy as regulators try to protect minors online. The European Commission is currently developing an age verification app that lets users prove their age using digital identities. This app, a precursor to the EU digital identity wallet planned for 2026, is intended to offer a secure and private method of age verification for online services that want to keep minors off their platforms. The EU has not mandated age verification, but under the Digital Services Act (DSA), very large online platforms and search engines are required to mitigate systemic risks relating to the protection of minors. The Electronic Frontier Foundation (EFF) has raised concerns about the potential of such systems. The debate continues as the EU tries to reconcile child protection with fundamental rights.

This investigation looks at Yoti, a leading provider of age verification and age estimation technology that describes itself as privacy-focused. The aim is to outline the data protection and security challenges of implementing age verification and estimation apps using a concrete example.

A brief introduction to Yoti

Yoti is an identity verification service provider that has in recent years also specialised in age verification and in estimating age from facial images and video selfies. On its corporate website, Yoti describes itself as follows:

“Yoti is a digital identity company that makes it safer for people to prove who they are. We started out by helping people with a free, reusable digital ID app that minimises the amount of data they share with businesses.”

It also describes one of its services as follows:

“A privacy-preserving approach to age verification.”

Yoti, corporate website

Yoti offers two main solutions for establishing age (according to its website, yoti.com):

• Age verification (usually checks ID documents, credit cards, mobile network operators or databases)
• Facial age estimation (based on video selfies)

Both solutions are implemented in the Yoti app, and they can also be integrated into third-party software using SDKs (software development kits). Yoti is a leading provider of age verification and age estimation technology. On its Google Play Store profile, Yoti states that the app “Yoti – your digital identity” has “over 14 million downloads”. In other marketing material, Yoti also claims to have carried out more than 500 million age checks in total. Large social media platforms such as Meta’s Instagram have implemented Yoti as an age verification or estimation solution in several countries, including some in the European Union.

The German Commission for the Protection of Minors in the Media (KJM) also assessed Yoti as a “positive technical measure” in 2021, which means it is likely to be widely used there as well.

Yoti’s other customers include Sony PlayStation, the French social networking app Yubo, Epic Games, and the adult websites XHamster and OnlyFans (illustration taken from: https://youtu.be/3VEsjFN_iSM?si=6mjaMMwJlihPymJ8&t=263).

Yoti’s large customer base justifies a close look at whether its data protection promises are kept, how seriously it takes user privacy, and how secure its AI models and the safeguards it has implemented really are.

Starting the investigation: the website and its cookie banner

On a first visit to Yoti’s website (yoti.com), a cookie banner appears immediately and asks the visitor to accept cookies.

While it is a positive sign that Yoti does not try to pressure users with dark patterns or similar techniques, a look at the network traffic is very disappointing. Observing that traffic shows that several connections to third parties are already established without the cookie banner having been clicked and without the user’s consent having been obtained. This behaviour occurs even after clicking “Reject all”. In short: the cookie banner does not appear to be implemented correctly, and third-party applications are loaded directly without any interaction or consent.

These resources are loaded immediately:

• Google Tag Manager: https://www.googletagmanager.com/gtm.js?id=GTM-TG7FD3
• Font Awesome: https://kit.fontawesome.com/3684eefa79.js
• Google Fonts hosted on googleapis.com: https://fonts.googleapis.com/css?family=Noto+Serif%3A400%2C400italic%2C700%2C700italic&subset=latin%2Clatin-ext&ver=6.7.1 and https://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin&ver=7.9
• jQuery hosted on googleapis.com: https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

Ironically, these resources are still loaded even when navigating directly to the Yoti Privacy Centre (https://www.yoti.com/privacy/) — an important detail for the analysis of the app that follows.

Examining the Yoti Android app: trackers and extensive permissions

As mentioned above, Yoti has had an app since 2016. According to Yoti it has been downloaded more than 14 million times. The Android app examined in this analysis, “com.yoti.mobile.android.live“, was released on 26 May 2025 (version 3.69.0).

For anyone who wants to reproduce the results described here, the following data is provided:

• Name: com.yoti.mobile.android.live.apk
• Size: 60307312 bytes (57 MiB)
• SHA256: 8EC516DA0C6F9DBEFC3BE4AA1E4C37D782566CB3BE28D3C2C9C3985B9991606F

An initial static analysis with the privacy tool “Exodus Privacy” via code analysis shows that at least four trackers are embedded directly in the app.

To confirm that this information is accurate, a dynamic runtime test was carried out with a custom tool and the app “TC Slim” (TrackerControl), which acts as a man-in-the-middle proxy so that network traffic can be inspected when the app starts.

The following resources were found to be loaded immediately after the app starts, without the user having given consent and without any substantial interaction with the app:

• Snowplow Analytics (com-yoti-prod1.collector.snplow.net)
• Google (firebase-settings.crashlytics.com)
• Adjust (app.adjust.com)
• Google (ajax.googleapis.com, clientservices.googleapis.com, content-autofill.googleapis.com, firebaseinstallations.googleapis.com)

The “Adjust” tracker used here collects the following information about the device:

• Device manufacturer: Google
• Android UUID: 9f1b2c48-8d45-4e32-942c-3a1a9bfe1f09
• Referrer (source of installation): Google Play Store
• Google advertising ID: a57c4db3-91f2-478b-ae3c-cc5dbe9d12a4
• Operating system: Android
• Display resolution: 1344×2992
• Tracking enabled: 1
• Hardware name: google_coral-user 14 AP1A.240405.002 1234567
• Package name: com.yoti.mobile.android.live
• App version: 3.69.0
• Device name: Pixel 8 Pro
• OS version: 14
• CPU: arm64-v8a
• […]

Taken together, this collection amounts to an almost unique fingerprint of the mobile device. It allows third parties to reliably recognise the same device in different contexts, even when the user has not identified themselves explicitly. The Google advertising ID is particularly concerning. Although it is marketed as a “resettable” identifier for advertising purposes, in practice it can be used to correlate activity across multiple apps.

When different apps on a user’s phone share this identifier with external services or data brokers, those parties can link the user’s behaviour across applications and potentially build a detailed profile of interests, habits and even sensitive information — for example, whether the user has installed apps relating to health, finance or identity verification such as Yoti.

The following diagram shows how such tracking can work (based on the Kuketz blog):

1. The user uses an app that captures the advertising ID.
2. A data broker combines the user data with existing information.
3. The user installs the Yoti app and the advertising ID is processed.
4. It becomes apparent that the same advertising ID can be linked to other activity.
5. Information about the installation of the Yoti app, and further actions, can be added to the existing data.

Including unique identifiers such as the Android UUID, the detailed hardware name and the screen resolution increases the risk further, because these can be used for persistent tracking even if the user resets their advertising ID. This undermines user consent and their expectations of privacy. In short, when such identifiers are collected and shared without strict limits, they pose a serious threat to user privacy: they enable long-term behavioural profiling, targeted manipulation and potential re-identification, even when the data is described as “pseudonymous”.

Yoti does not ask for consent to use the advertising ID via Adjust. Its privacy policy for the Yoti app does mention that such data collection takes place, but the risk associated with this kind of collection is not explained or described in any detail:

As can be seen in several places in the privacy policy, hashing is mentioned as a way of “protecting” information. A clearer description of the concept is missing, and processing of the advertising ID is described elsewhere, but there are further problems with hashing itself. Hashing is often misunderstood as a secure method of protecting user data, yet it still carries significant privacy risks. Although hashing turns information into an unreadable string, it does not make the data genuinely anonymous. If the original information — such as advertising identifiers or common user actions — is predictable or drawn from a limited set, attackers can use techniques such as dictionary attacks or rainbow tables to reverse the hash and recover the original data. Hashed identifiers can also be used to track users over long periods, because they remain consistent, which enables behavioural profiling even without knowing the user’s actual identity.

This undermines user privacy and makes hashing a form of pseudonymisation rather than true anonymisation. If the hashing algorithm is outdated, or implemented without additional randomisation such as salting, the data becomes more vulnerable still. Overall, hashing does add a layer of protection, but on its own it is not sufficient to safeguard user privacy or to meet stricter data protection standards.

Beyond that, opt-in by default in Adjust is not privacy-friendly. At the very least, consent via an in-app cookie banner would have to be implemented to achieve GDPR compliance — or, better still, not to use such trackers at all when claiming to offer “a privacy-preserving approach to age verification”. The other trackers in the app also send sensitive information from the device to third parties, such as Google Firebase, which has been criticised in the past.

Alongside the trackers, “Exodus Privacy” also revealed a very broad set of permissions, which we independently verified by reviewing the app’s AndroidManifest.xml.

The following permissions are requested:

• ACCESS_ADSERVICES_AD_ID
• ACCESS_ADSERVICES_ATTRIBUTION
• ACCESS_COARSE_LOCATION (access approximate location only in the foreground)
• ACCESS_FINE_LOCATION (access precise location only in the foreground)
• ACCESS_NETWORK_STATE (view network connections)
• ACCESS_WIFI_STATE (view Wi-Fi connections)
• CAMERA (take pictures and videos)
• FLASHLIGHT
• FOREGROUND_SERVICE (run foreground service)
• FOREGROUND_SERVICE_DATA_SYNC
• GET_ACCOUNTS (find accounts on the device)
• HIDE_OVERLAY_WINDOWS
• INTERNET (have full network access)
• NFC (control near field communication)
• POST_NOTIFICATIONS
• RECEIVE_BOOT_COMPLETED (run at startup)
• RECORD_AUDIO (record audio)
• USE_BIOMETRIC (use biometric hardware)
• USE_FINGERPRINT (use fingerprint hardware)
• VIBRATE (control vibration)
• WAKE_LOCK (prevent phone from sleeping)
• RECEIVE
• BIND_GET_INSTALL_REFERRER_SERVICE
• AD_ID
• DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

It is questionable why an app like Yoti needs access to the advertising ID at all (as we have seen, it was used by the Adjust tracker in the app), or to precise location data, or to information about the user accounts on the device.

As noted in the website section of this article, third-party resources are loaded when the privacy notices are displayed, before any user interaction takes place. This also applies to the Android app — and very probably to the iOS app as well — because Yoti uses a web view to request and display its privacy notices.

This means the web page is loaded, and third-party applications are requested without the user’s explicit consent.

Ironically, just before the user clicks the link to the privacy policy — which triggers that transmission — the app states that “we are committed to protecting your privacy”, while user data (including IP addresses, which can be considered personal data under the GDPR) is transmitted directly to Google and other third parties.

Tracing the supply chain: a company in Spain trains Yoti’s models in Google Cloud

Anyone who looks closely at Yoti’s solution and searches for information about the product will find a reference page from a company in Spain (Málaga) called “Algorath”.

On its website, Algorath states clearly that Yoti commissioned it to develop Yoti’s age verification tool from 2018 onwards and to support the training and improvement of the AI models.

Using the Certificate Transparency protocol, we identified Algorath subdomains that were used for purposes connected to Yoti and its products.

The endpoints include the following domains:

• nuget.yotiai.algorath.com
• age.yotiai.algorath.com
• sandbox.yotiai.algorath.com
• datacollection.yotiai.algorath.com
• metadatabe.yotiai.algorath.com
• — and others —

All of these domains are hosted in Google Cloud.

Visiting one of them presents a Google login in most cases; in some cases the tools are directly accessible. It is possible to authenticate with an ordinary Google account.

The example shows a web interface belonging to Algorath/Yoti on which data collection takes place that could later be used to train models for detecting virtual cameras. Virtual cameras are one potential way of bypassing age estimation tools such as Yoti’s facial scans by presenting a forgery of a person’s face. Such attacks are often referred to as “digital injection attacks”. In a blog post, Yoti describes its countermeasures against attacks of this kind. These measures are described as an additional layer of security — they appear to be part of level 3, “injection attack detection” — and underline how important fraud detection is to Yoti’s business model. The following diagram is taken from a Yoti talk given in late 2024.

With a large volume of training data — for example characteristics and hardware IDs from many cameras — it becomes easier for Yoti to detect whether an end user is using a virtual rather than a physical camera to bypass the age verification or estimation system. Yoti can then restrict access when fraudulent behaviour is detected, although this also carries considerable risks.

On the one hand it can produce false positives, where a physical camera is wrongly identified as a virtual one and a user’s legitimate attempt to verify their age is blocked. False positives and other technical faults can cost users access to services and content, as extracts from the Google reviews of the app show:

On the other hand, this type of spoofing and fraud detection is itself a risk to user privacy. Detecting unlawful actions and users requires a great deal of data to be processed: alongside general network and device information, data from the cameras is also used, such as frame rate, device names and in some cases a unique identifier.

Via web APIs such as enumerateDevices, Yoti and other age estimation solutions can read out specific devices and their IDs once the user has granted camera permission — which is normally necessary in order to use the service at all. A small proof of concept was implemented and shows that this kind of detection, or camera fingerprinting, is readily possible.

Given how much image generators have improved, and how much easier it has become to produce convincing deepfakes, Yoti has probably decided to take a two-pronged approach to fraud detection: focusing not only on the manipulated content, but also on the metadata and devices involved, their behaviour and the metadata associated with them. In 2022 the Chaos Computer Club demonstrated that the German “Post-Ident” approach (an identity verification solution) and other video-based identification mechanisms could easily be tricked.

Other endpoints without authorisation controls, found via particular subdomains, indicate that Yoti has at least two AI training models for its age estimation model (March 2023 and August 2024).

Other interfaces, for example for general data collection, were somewhat better protected:

It is plausible that only appropriate users and roles have access to that system. This is a level of protection that should be implemented.

In other cases, the interface indicated that general user registration had been successful but that an administrator needed to review the account before granting access — which did not happen.

Conclusions from our investigation

This investigation found that Yoti tracks users extensively on its website and in its app without their consent. Sensitive information such as the advertising ID and other personal data is transmitted to third parties (such as the advertising network Adjust) by default and without consent. This behaviour represents a potential breach of the GDPR, which requires unambiguous consent for the processing of personal data and its disclosure to third parties.

Beyond that, Yoti’s fraud detection and virtual camera detection rely on data that could potentially be manipulated by third parties, which shows how vulnerable the supply chain of an age estimation provider can be. Strong security safeguards and adequate transparency are necessary measures that providers such as Yoti should put in place. Detection mechanisms like Yoti’s injection attack countermeasures also illustrate the potential negative effect of fraud detection on user privacy: a high detection rate for fraudulent activity always means a deep intrusion into user privacy through fingerprinting of metadata and devices.

The behaviour observed here sits at odds with the company’s stated mission of “becoming the world’s most trusted identity platform”, because trust is built through concrete technical implementation and actions, not through statements.

We informed Yoti of our investigation and our observations on the morning of 4 June 2025, and will update this blog post here as we receive responses.

A short summary of Yoti’s statement:

1. Yoti states that the public endpoints mentioned pose no threat and were deliberately accessible. It also states that no data is automatically incorporated into Yoti models.
2. Yoti confirms that advertising IDs are used in the apps, but points out that this processing is at least pseudonymised and refers to the company’s legitimate interests in improving its products.
3. Yoti confirms that third-party content was loaded on the website inadvertently and that this was a “technical error”. It also stated that no cookies are set (which was never claimed).

Mint Secure’s assessment: We are pleased that Yoti takes our feedback seriously and responds quickly to reports of this kind.

How Mint Secure can help

Whether you are a provider of identity or age verification solutions, an app developer or a platform operator: anyone processing sensitive user data should have their tracking, permissions and supply chain reviewed regularly. We support you with the following services:

/