Written evidence submitted by Yoti

DCMS Committee inquiry into the growth of ‘immersive and addictive technologies’

Reference - preventing underage platform usage submitted by Yubo

1. The UK has led the way in terms of developing robust approaches to preventing underage gambling.Companies such as Snap state that they do not want underage users on their platforms. They express that there is currently “no foolproof way” to prevent under 13s from signing up. They agree that current parental consent approaches are trivially easy for children to circumvent — such as by setting up spoof email accounts or taking a photo of a parent’s passport or credit card to use for verification.

2. We would encourage the committee and DCMS to support the development of new parental consent mechanisms, age verification and age estimation techniques. As we have shared with the Science and Technology Committee regarding age verification for under-18s and to the DCMS, Home Office, GCHQ teams looking at age verification in the light of Internet harms - Yoti offers a number of safeguarding approaches. We are also keen to bring new parental consent mechanisms to market.

3. Yoti is an identity verification platform that enables companies to offer age verification anonymously. This means that, in line with the Digital Economy Act, any person can prove that they are over or under any given age, without having to share more data than is necessary with the counterparty.  It is extremely difficult for any individual to circumvent Yoti’s platform. Yoti has put safeguards in place at each step of the registration process, as well as in the technology, as detailed in Appendix.

4. We are working to make the internet a safer place for all users by allowing robust age gating in websites or apps that require it.  Yoti can allow children’s sites to prevent adults that are over 18 from accessing them, which keeps the environment safer for children and helps prevent grooming. With the NSPCC Childline and IWF we can support a Report Remove tool to enable an under 18 year old to share their under 18 attribute to apply to remove indecent images or sexting.  We are working with a number of online dating and classified sites in the UK, US, and India that allow consumers to verify certain details to increase their trust, create an optional or mandatory verified profile.

5. It is frequently cited that it is too difficult for young people to prove their age.

6. The penetration of Government-issued identity documents varies in different geographies but 72.6% of 13 to 18 year olds have a passport[1]. The Home Office approved PASS cards enable young people to prove their age but they are only freely distributed in Scotland. The school databases could be used by Government should they wish to allow identity companies to check on a yes/no basis that a child or young person is over 13, 13-17 or 18 and over.

7. Yoti is working with CitizenCard to distribute free Yoti CitizenCards to young people in England and Wales. Clearly the PASS Scheme should not be a postcode lottery as to whether a young person can prove their age offline or online. To deny poorer children the right to prove their age offline or online is a clear and embarrassing case of the government extending, rather than eliminating social exclusion. This would allow young people who may not have a passport or driving licence to set up a Yoti digital identity using their CitizenCard, with Yoti checking the source database for veracity. Essex County Council, CitizenCard and Yoti will be distributing free Yoti CitizenCards to all Essex secondary school children, sixth form college and university students from February 2019.

8. Yoti’s current solution is focussed on young people aged 13 and above. Where parental consent may be required for a child, for example, for additional personal data collection from under 13s, we are launching Yoti Connections. This is a service that allows a verified adult to vouch they are the parent of a child and vice versa.

9. We also offer Yoti Sign which enables a verified adult to e-sign consent that a child is theirs and has permission to do something (go on a school trip, or access a website using a specific email address).

10. No system is foolproof but there is now a range of technology approaches which allow teenagers and their parents to provide proof of age. We could for instance only allow an adult over 25 to vouch for a child being over 13 to reduce the likelihood of young adults risking lying that they are the parent of a child and that the child is over 13.

11. Yoti also has developed a trusted age estimation AI software - Yoti Age Scan. It has been designed to be anonymous, with data privacy and security as primary considerations. The user simply presents their face in front of the camera and once the age estimate is performed, the captured facial image is deleted. The mean error rate in years is 3.18 years and is lower for estimating the age of younger aged people at 2.29 years for 11-17 year olds. Yoti is working with live streaming platform Yubo to age estimate that 13-17 year olds and over 18s are in the right self asserted age range. Yoti can offer age verification for those who appear to be in the wrong age band and also verified profiles, which are proving popular and a premium feature as they help build trust in a profile. As Yoti becomes more popular each month, the training set increases and the age accuracy increases.

12. Most teenagers aged 16 or older will easily be able to use this service to give high confidence they are over 13. We are confident that with cooperation to access permissioned data sets the solution will be able to competently age estimate 11-17s to a similar degree of confidence. This technique is low cost and does not require all young people to purchase driving licences or passports for ID rather than driving or travel to foreign countries. Regulators will have to decide whether the relatively high accuracy of this tool makes it an effective age tool or whether all young people will need to continue to provide physical ID documents to prove their age offline or no age gating is performed online.

13. Yoti is a consumer champion, giving individuals control of their digital identity and minimising the data they need to present offline or online to interact with other individuals and organisations. Trust and transparency are core principles. We have published a Whitepaper on how we use AI responsibly and we disclose our training data sets (volume, gender, ethnicity) to ensure regulators and the general public globally can gain trust in this new area of science.

14. Prior to GDPR social media companies were unaware of Yoti but over the last months interest to understand age estimation services is growing. One of the world’s largest social media platforms for young people, Yubo, has been using Yoti to increase its ability to safeguard the children using its service.

15. At present, companies such as Snap are not ensuring that very young people with smartphones are not exposed to inappropriate material, or grooming.  We would like it to be known that tools such as age estimation are now available to assist in the protection of young people from possible online harms.  As demonstrated by the collaboration between Yoti and Yubo, it’s possible to keep young people safe online in a way that’s inobtrusive, reliable and secure.

Please find below additional information about Yoti.

We welcome the opportunity to present our evidence to the Committee in respect of this matter.

March 2019

Appendix

About Yoti

In a nutshell, Yoti is an identity checking system that allows organisations to verify who people are, online and in person.

We are a team of 230 based in London, with offices in Mumbai and later in 2018 opening in the US and Canada. We count over 3.7 million installs of the Yoti app, following our launch in November 2017.

How it works

For consumers, it’s an app that helps them prove who they are and confirm the identities of others. We distinguish ourselves with our approach to privacy and security, so the system has been architected so that it's impossible for us to monetise users’ personal data (see our FAQs for technical detail). The app is in the app stores. The set-up involves a four-minute process, where you link your facial biometrics to your phone and validate against a government-issued identity document. Identities are verified using NIST approved facial recognition technology, government issued identity documents and where possible, biometric passport chips.

Once you've completed set-up, your Yoti securely holds verified attributes of your identity, such as date of birth, gender and nationality. You can then use the app to share those attributes of your identity with other people, organisations and websites. This might be for age verification in the offline or online world or to populate fields on an online form.

Onboarding
Onboarding onto the free Yoti app by users takes less than five minutes. To reduce the risk of fraud Yoti requires users to verify their mobile devices with a one-time password, to set a five digit PIN and to pass a 'liveness' test. Yoti also takes a selfie of the user to create a biometric template of that person. Once the user has passed liveness they can then take a photo of their government-issued identity documents. Yoti accepts ID documents from over 160 countries around the world. Yoti captures the data on the identity documents (either using OCR technology, or by manually adding the data) and then verifies the data (please see below). Once verified, the details from the document are held separately and encrypted and only the user can access them.

Verification
Yoti operates a Security Operations Centre, where trained document checkers who have demonstrated an above-average ability to recognise people conduct the online identification process. The Security Operations Centre personnel check the images of the user-submitted ID documents against a global database of ID documents.  They are trained to check the security features and to look for evidence of tampering.  They also check that the photo on the document matches the person trying to onboard that document.  Where possible, we use leading face matching technology to check the document matches the person submitting it.  Finally, Yoti can also authenticate data on the document chip if that is possible.

Data sharing by the user
The Yoti dashboard allows organisations to select what verified attributes they need from each user.  Examples of verified attributes users can share include name, address, gender, nationality, date of birth, selfie and address. Organisations can also ask for a 'selfie authentication' to be performed before the data is shared to biometrically ensure that the correct user is sharing the data from the Yoti app.  This requires the user to take a selfie and then the Yoti system automatically performs a biometric face match against the selfie taken on registration.  Yoti uses a market leading company (highly rated by NIST and used by a large European border force) for this face match.

No data is shared unless the user has agreed in the app before each data share with each requesting entity.

Receipts
Once a data share has taken place, each party receives a 'receipt'.  This details the attributes sent / received and is timestamped. The receipt has metadata giving further data about the attributes (including the source of the data). For organisations receipts are stored on the Yoti dashboard and they can export this data at any time. For users receipts are available through the app as well as though a dashboard.

Security

Yoti has the ISO 27001 certification and is also ISAE 3000 (SOC 2), Type 1 certified for its technical and organisational security processes. We are a Secured by Design member company having had our digital identity app accredited by Secured by Design in 2018 (for all areas except Alcohol Licensing). In doing so, Secured by Design has recognised the high standards of security that the Yoti app provides when an individual uses it to prove their identity, online and in person.

Personal data is stored on our systems in such a way that even if our systems were hacked and decrypted, the fraudsters could still not make sense of the data because they need the private keys stored on the mobile devices of users.

Memberships

Yoti is a cross-sector, mobile friendly, and consumer-friendly identity verification system. We have been part of the UK Digital Policy Alliance steering group creating the 1296 Age Checking PAS, which is being made into a British Standard, chaired by Lord Erroll at Westminster ahead of the Digital Economy Act. Yoti staff serve as industry chair for the DPA Age Verification & Internet Safety Steering Group;  sponsor of the APPG Digital Identity, serve on the Home Office Identity Document Working Group, and are a member of the newly formed Association of Document Validation Professionals and the Age Verification Providers Association. We are members of TechUK groups for Public Services Board, Justice & Emergency Services, Data Protection and Digital Identity. We are a key partner of London Digital Security Centre, set up by the City of London Police, Met Police and the London Mayor's Office to help businesses innovate, grow and prosper through operating in a secure digital environment.

We are members of Open Identity Exchange, and in addition to working with a range of commercial companies (NCR, national retailers, online dating and e-commerce players in India), we have been announced as the eID provider for the States of Jersey, and the Improvement Service Scotland and are working with a number of national charities such as the Scouts and NSPCC. We are working with the FCA Regtech sandbox in conjunction with global insurers. We are a registered BCorps and have set up a Guardians Council to hold us to account; as well as working with Responsible 100, Doteveryone Sustainable Tech Trust Mark Prototyping, and EU Compass Responsible Innovation to assist us in developing our ethics framework.