Written evidence submitted by Yoti (DCG0039)

Dear Select Committee members,

Thank you for the opportunity to present to the Select Committee hearing on 13th May.

Given the short time we had, I attach a written summary to the questions posed.

1. Definition and benefits of digital ID
2. The partnership between Yoti and Citizen Card
3. The different types of citizens that use digital ID and how you make your product offer as inclusive as possible
4. In terms of retail use cases - how could reusable digital ID and facial age estimation work side by side?
5. How you approach the safeguarding of user data and whether there are any lessons for the public sector here
6. The planned GOV.UK Wallet and DSIT’s broader proposals for a digital centre
7. What would happen, would would a citizen do, if a digital identity company were to go bust
8. How does digital identity support fraud prevention

1. Introduction, Benefits and Use Cases

Digital identity (digital ID) is a foundational tool for secure, private, and efficient identity verification. Yoti provides a free mobile application that enables individuals to create, store, and present their identity digitally. It serves as a privacy-preserving alternative to physical documents and supports both formal and informal forms of verification, such as document uploads or facial age estimation.

To date, the Yoti Digital ID Wallet has been downloaded over 15 million times globally, including by more than 5.6 million UK users. Yoti is the strategic partner for Lloyds Bank and the Post Office, providing reusable, certified digital ID apps that form part of the interoperable Digital ID Connect network.

Benefits and Use Cases

Digital ID supports a wide range of functions for individuals, businesses, and public sector organisations. Key benefits include:

• Selective disclosure: Users can share only the specific data required, such as age without a full date of birth.

• Security and speed: Businesses and service providers can verify users instantly, improving service efficiency and reducing fraud.

• Anonymity options: Features like facial age estimation enable people without documents to verify their age without revealing identity.

Examples of usage and uptake:

• One in three UK adults conducting an online DBS check do so using a certified digital ID.

• One in four Right to Work checks is completed with a digital ID wallet.

• One in six 18-year-olds has used Yoti to access their Child Trust Fund.

• Over 25% of all 18 to 22-year-olds in the UK have created a Yoti digital ID.

See report, Digital Identity Sectoral Analysis 20251 by Oliver Wyman, Perspective Economics, Projects by IF and Survation[1]

2. The Yoti–CitizenCard Partnership

Yoti and CitizenCard launched a joint ID solution in 2018—the Yoti CitizenCard. It provides a government-approved, low-cost identity option designed to enhance safety for young people both online and offline.

Key features of the Yoti CitizenCard include:

• Accepted for purchasing age-restricted goods such as vapes, lottery tickets, and accessing cinemas.

• Four age bands: Under 13, 13–15, 16–17, and 18+.

• Compatible with the Yoti app for use as a reusable digital ID.

• Reduced personally identifiable information on the physical card, supporting safer use.

The Yoti CitizenCard is especially useful in enabling teenagers to prove they are over 13 in a safe, controlled way—supporting compliance with social media age requirements and access to online services.

3. Ensuring Inclusion Across Citizen Types

Yoti recognises the need for inclusive digital identity solutions that cater to all groups in society. The table below outlines the main citizen types, their typical use cases, the associated regulatory landscape, and design needs.

This diverse regulatory environment illustrates the need for joined-up policymaking and shared standards across departments. Without coordination, users face inconsistent recognition of digital IDs across sectors.

How Yoti Designs for Inclusion

Yoti integrates inclusive design into every layer of its services. Core principles include:

• Document flexibility: Users can verify with or without formal ID documents, including from over 180 countries.

• Multiple access points: Web, app, and assisted onboarding channels.

• Age inclusion: Facial age estimation built into the app, with no storage of images.

• Free to use: All individual users can access the Yoti app at no cost.

• Accessibility standards: WCAG 2.1-compliant interfaces with plain language and localisation.

• Ethical governance: Oversight from the independent Guardians Council and an internal Ethics and Trust Committee.

• Community partnerships: Collaboration with NGOs, local authorities, youth organisations, and accessibility advocates.

4. In terms of retail use cases - how could reusable digital ID and facial age estimation work side by side?

In the Home Office Retail of Alcohol sandbox trials,[2] evidence showed that the vast majority of citizens opted to use facial age estimation, which detects a face, analyses it, gives the result back to the retailer of over 18 or not, without any unique recognition. This helps the 24% of UK adults who do not have photo ID. This appetite mirrors what we see in the online world, when individuals are given the choice of several options, over 80% of users opt for facial age estimation, versus approaches linked to identity documents. Over 99,000 tests were conducted, at major UK supermarkets and no minors were able to access age restricted goods. Retailers are keen to be able to offer citizens the choice of using either facial age estimation or a reusable digital ID.

5. Safeguarding Data and Ensuring Trust

Yoti employs a privacy-first approach backed by strong encryption and ethical standards.

Key safeguards include:

• Privacy by design: Only necessary data is collected and shared, with explicit user consent.

• Split-key encryption: Ensures that no single party can access a full user profile.

• Facial age estimation: Uses biometric analysis without storing facial images.

• Regulatory compliance: Adheres to GDPR, eIDAS, COPPA, ISO 27001, and SOC2 standards.

• User control: Individuals can view, delete, or export their data at any time.

• Independent oversight: Yoti undergoes third-party audits and contributes to global standards discussions.

• Ethics and transparency: All high-risk product decisions are reviewed by internal and external ethics bodies.

6. Reflections on the GOV.UK Wallet and DSIT’s Strategy - can the two co-exist?

Yoti welcomes the UK Government’s ambition for digital transformation. The launch of the GOV.UK Wallet marks a major milestone in expanding trusted digital identity. When implemented well, such systems can reduce fraud, simplify services, and improve outcomes for citizens.

Prior to the 14th May joint meeting between GDS OfDIA & Industry serious concerns were voiced. (14th May meeting provided a lot more clarity, as per this post on Linked In by Yoti CEO, Robin Tombs)

According to discussions led by techUK, ADVP, and AVPA:

• The private sector seeks clarity as to the remit for the GOV.UK Wallet

• Clear functional boundaries for the GOV.UK wallet and other members of the ecosystem are needed to enable the government to rebuild trust and create competitive conditions.

• The private sector looks for clarity in terms of fair competition, transparency.

To maintain a balanced digital ID ecosystem and restore confidence, the following measures are recommended:

• Limit GOV.UK Wallet use to public sector services through statutory definition.

• Guarantee interoperability between GOV.UK Wallet, One Login, and DIATF-certified wallets.

• Legally affirm DIATF-certified wallets as equal in status to GOV.UK credentials to avoid a two-tier system.

• Establish independent oversight over certification and grievance processes to remove conflicts of interest.

• Ensure fair access to data such as National Insurance numbers through secure, certified gateways

• Publish impact assessments and business cases for the GOV.UK Wallet to support transparent decision-making.

• Reinstate structured industry engagement via forums like OLIPAG or PCAG.

• Recognise certification bodies as key to ensuring competition, innovation, and public trust.

• Adopt regulatory consistency so that validated solutions are accepted across departments within a reasonable timeframe.

The UK has an opportunity to lead the world in ethical and inclusive digital identity. However, this can only be achieved through transparency, interoperability, and collaboration between the public and private sectors. Yoti urges the government to maintain open engagement, ensure legal parity for certified wallets, and work across regulators to deliver a secure, trusted, and inclusive identity ecosystem for all.

7. What would happen, would a citizen do, if a private digital identity company were to get into financial difficulty and go bust, what measures are there to access data?

All identity providers have to be able to export data under GDPR, including those from DIATF organisations, the government or other identity wallet providers. I attach screenshots of the steps to do this from the Yoti app, as an example.

We trust that the UK government will look to provide the right conditions for organisations accredited to the DIATF to flourish and meet the wider needs of citizens in terms of choice and the specific needs of UK and global businesses.

8. How does digital identity support fraud prevention, stop fraud and scams

Digital identity helps prevent fraud by ensuring that individuals are who they claim to be. Verified digital IDs rely on secure checks using government-issued documents and facial biometrics, making impersonation and identity theft significantly harder. Once verified, a digital ID can be reused safely across services, reducing the need to repeatedly expose personal data.

These systems also allow for selective disclosure. For example, someone can prove they are over 18 without revealing their full date of birth. This minimises opportunities for phishing, data misuse, and social engineering. Strong encryption and decentralised data storage protect personal information, even from the identity provider.

Critically, using a biometric digital ID linked to a verified identity document to commit fraud is the equivalent of committing a burglary in front of a CCTV camera. You would either have to be extraordinarily reckless or a highly sophisticated criminal to attempt it. The presence of a facial biometric, tied to a government credential, makes fraudulent activity traceable and legally risky, acting as a strong deterrent.

Digital ID also stops repeat offending. Fraudsters cannot easily create new identities after being removed from a platform. In sectors like finance, hiring, or age-restricted services, digital ID closes the gap between onboarding and enforcement by making trusted identity proof part of the process from the start.

By reducing reliance on self-declared information and raising the bar for trust, digital identity makes fraud more difficult, riskier, and easier to detect.

13 May 2025