Written evidence submitted by Yoti (SMH0177)

We are writing to you with regards to the oral evidence published on the 16th of October by the Science and Technology Committee, on the issue of age verification.

During the inquiry, Daniel Moore MP asked the witnesses the following: “Do you think that there will ever be an age verification process that is robust enough, or do you think that it will always be circumvented by children? Given the fact that we pretty much now just ask for a date of birth or a tick in a box, and children are much more intelligent than that and can get around it, is there anything else that could be put in place, which they could not circumvent?” (reference Q517)

To which witness Karim Palant, UK Policy Manager for Facebook, answered: “I am not aware of anywhere where there is an age verification process for people in their teens that would compare with the BBFC process that is still being worked on for 18-year-olds for pornography here in the UK.” (reference Q518)

Further, witness Sinead McSweeney, Vice-President of Public Policy and Communications for Europe, the Middle East and Africa region for Twitter, answered: “On the age verification question, again there is a tension between how much data you collect about your users to facilitate it. Of course, children will always seek to do that which they are not supposed to do.” (reference 518)

We agree that the current age verification techniques used - a tick box or entering manually the date of birth - are not robust enough and allow anyone, including children, to circumvent them easily.  We believe we can offer a solution for that issue. An increasing number (266) of products and services are age restricted (most 15, 16 and 18 years) it is increasingly important that all young people can easily prove their age offline and online.

Yoti is an identity verification platform that enables companies to offer age verification anonymously. This means that, in line with the Digital Economy Act, any person can prove that they are over or under any given age, without having to share more data than is necessary with the counterparty.  It is extremely difficult for any individual to circumvent Yoti’s platform. Yoti has put safeguards in place at each step of the registration process, as well as in the technology, as detailed in Appendix.

We are working to make the internet a safer place for all users by allowing robust age gating in websites or apps that require it.  Yoti can allow children’s sites to prevent adults that are over 18 from accessing them, which keeps the environment safer for children and helps prevent grooming. With the NSPCC Childline and IWF we can support a Report Remove tool to enable an under 18 year old to share their under 18 attribute to apply to remove indecent images or sexting.  We are working with a number of online dating and classified sites in the UK, US, and India that allow consumers to verify certain details to increase their trust, create a optional or mandatory verified profile.

It is frequently cited that it is too difficult for under 18s to prove their age.

The penetration of Government-issued identity documents varies in different geographies but 72.6% of 13 to 18 year olds have a passport. The Home Office approved PASS cards enable young people to prove their age but they are only freely distributed in Scotland. The school databases could be used by Government should they wish to allow identity companies to check on a yes/no basis that a child or young person is over 13, 13-17 or 18 and over.

In Scotland the Young Scot Card is issued free to all young people and The Improvement Service (IS) will soon enable Yoti to check the validity of Young Scot cards via The IS API, as we already do with the Yoti CitizenCard partnership. This would allow young people who may not have a passport or driving licence to set up a Yoti digital identity using their CitizenCard, with Yoti checking the source database for veracity. Essex County Council, CitizenCard and Yoti will be distributing free Yoti CitizenCards to all Essex secondary school children, sixth form college and university students from February 2019.

Yoti is working with CitizenCard to distribute free Yoti CitizenCards to young people in England and Wales. Clearly the PASS Scheme should not be a postcode lottery as to whether a young person can prove their age offline or online. To deny poorer children the right to prove their age offline or online is a clear and embarrassing case of the government extending, rather than eliminating social exclusion.

Yoti’s current solution is focussed on young people aged 13 and above. Where parental consent may be required for a child, for example, for additional personal data collection from under 13s, we are launching Yoti Connections in Q1 2019. This is a service that allows a verified adult to vouch they are the parent of a child and vice versa.

We also offer Yoti Sign which enables a verified adult to e-sign consent that a child is theirs and has permission to do something (go on a school trip, or access a website using a specific email address).

No system is foolproof but there is now a range of technology approaches which allow teenagers and their parents to provide proof of age. We could for instance only allow an adult over 25 to vouch for a child being over 13 to reduce the likelihood of young adults risking lying that they are the parent of a child and that the child is over 13.

Yoti also has developed the world’s leading age estimation AI software - Yoti Age Scan. It has been designed to be anonymous, with data privacy and security as primary considerations. The user simply presents their face in front of the camera and once the age estimate is performed, the captured facial image is deleted. The mean error rate in years is just 4.0 and is lower for estimating the age of younger aged people. As Yoti becomes more popular each month, the training set increases and the age accuracy increases.

Most teenagers aged 16 or older will easily be able to use this service to give high confidence they are over 13. It will be difficult for under 11 year olds to use the software to give high confidence they are over 13. The solution will initially struggle to give high confidence that all 11 and 12 year olds are under 13 and that all 14 or 15 year olds are over 13 but with time, the accuracy will improve and the range of children unable to verify age with high confidence will fall. This technique is low cost and does not require all young people to purchase driving licences or passports for ID rather than driving or travel to foreign countries. Regulators will have to decide whether the relatively high accuracy of this tool makes it an effective age tool or whether all young people will need to continue to provide physical ID documents to prove their age.

Yoti is a consumer champion, giving individuals control of their digital identity and minimising the data they need to present offline or online to interact with other individuals and organisations. Trust and transparency are core principles. We will publish White Papers on how we use AI responsibly and we will disclose our training data sets (volume, gender, ethnicity) to ensure regulators and the general public globally can gain trust in this new area of science.

Asking only social media companies whether there is effective age verification for children to prove they are over 13, or adults are over 18 is unlikely to get a full answer given such companies are focused on encouraging adoption of their platforms with minimal friction.

Large US social media companies are aware of Yoti but unsurprisingly have shown no appetite to use the service. One of the world’s largest retailers, with a higher desire to check products / services are only offered to adults begins trials of using Yoti by January 2019.

Today it is easy for a child to buy a knife from a seller on Facebook marketplace, with Facebook not imposing any effective age verification on the buyer or seller. This clearly would be completely unacceptable in the offline world, but seemingly is not enforced by Trading Standards, the Home Office or Police online.

We welcome the opportunity to present our evidence to the Committee in respect of this matter.

Please find below additional information about Yoti.

November 2018

Appendix

About Yoti

In a nutshell, Yoti is an identity checking system that allows organisations to verify who people are, online and in person.

We are a team of 230 based in London, with offices in Mumbai and later in 2018 opening in the US and Canada. We count over 2.5 million installs of the Yoti app, following our launch last November.

How it works

For consumers, it’s an app that helps them prove who they are and confirm the identities of others. We distinguish ourselves with our approach to privacy and security, so the system has been architected so that it's impossible for us to monetise users’ personal data (see our FAQs for technical detail). The app is in the app stores. The set-up involves a four-minute process, where you link your facial biometrics to your phone and validate against a government-issued identity document. Identities are verified using NIST approved facial recognition technology, government issued identity documents and where possible, biometric passport chips.

Once you've completed set-up, your Yoti securely holds verified attributes of your identity, such as date of birth, gender and nationality. You can then use the app to share those attributes of your identity with other people, organisations and websites. This might be for age verification in the offline or online world or to populate fields on an online form.

Onboarding
Onboarding onto the free Yoti app by users takes less than five minutes. To reduce the risk of fraud Yoti requires users to verify their mobile devices with a one-time password, to set a five digit PIN and to pass a 'liveness' test. Yoti also takes a selfie of the user to create a biometric template of that person. Once the user has passed liveness they can then take a photo of their government-issued identity documents. Yoti accepts ID documents from over 160 countries around the world. Yoti captures the data on the identity documents (either using OCR technology, or by manually adding the data) and then verifies the data (please see below). Once verified, the details from the document are held separately and encrypted and only the user can access them.

Verification
Yoti operates a Security Operations Centre, where trained document checkers who have demonstrated an above-average ability to recognise people conduct the online identification process. The Security Operations Centre personnel check the images of the user-submitted ID documents against a global database of ID documents.  They are trained to check the security features and to look for evidence of tampering. They also check that the photo on the document matches the person trying to onboard that document. Where possible, we use leading face matching technology to check the document matches the person submitting it. Finally, Yoti can also authenticate data on the document chip if that is possible.

Data sharing by the user

The Yoti dashboard allows organisations to select what verified attributes they need from each user.  Examples of verified attributes users can share include name, address, gender, nationality, date of birth, selfie and address. Organisations can also ask for a 'selfie authentication' to be performed before the data is shared to biometrically ensure that the correct user is sharing the data from the Yoti app.  This requires the user to take a selfie and then the Yoti system automatically performs a biometric face match against the selfie taken on registration. Yoti uses a market leading company (highly rated by NIST and used by a large European border force) for this face match.

No data is shared unless the user has agreed in the app before each data share with each requesting entity.

Receipts
Once a data share has taken place, each party receives a 'receipt'.  This details the attributes sent / received and is timestamped. The receipt has metadata giving further data about the attributes (including the source of the data). For organisations receipts are stored on the Yoti dashboard and they can export this data at any time. For users receipts are available through the app as well as though a dashboard.

Security

Yoti has the ISO 27001 certification and is also ISAE 3000 (SOC 2), Type 1 certified for its technical and organisational security processes. We are one of Secured by Design’s newest member companies having had our digital identity app accredited by Secured by Design earlier in 2018 (for all areas except Alcohol Licensing). In doing so, Secured by Design has recognised the high standards of security that the Yoti app provides when an individual uses it to prove their identity, online and in person.

Personal data is stored on our systems in such a way that even if our systems were hacked and decrypted, the fraudsters could still not make sense of the data because they need the private keys stored on the mobile devices of users.

Memberships

Yoti is a cross-sector, mobile friendly, and consumer-friendly identity verification system. We have been part of the UK Digital Policy Alliance steering group creating the 1296 Age Checking PAS, which is being made into a British Standard, chaired by Lord Erroll at Westminster ahead of the Digital Economy Act. We are industry chair for the DPA Age Verification & Internet Safety Steering Group;  sponsor of the APPG Digital Identity, serve on the Home Office Identity Document Working Group, and are a member of the newly formed Association of Document Validation Professionals and the Age Verification Providers Association. We are members of TechUK groups for Justice & Emergency Services, Data Protection and Digital Identity. We are a key partner of London Digital Security Centre, set up by City of London Police, Met Police and the London Mayor's Office to help businesses innovate, grow and prosper through operating in a secure digital environment.

We are members of Open Identity Exchange, and in addition to working with a range of commercial companies (NCR, national retailers, online dating and e-commerce players in India), we have been announced as the eID provider for the States of Jersey, and the Improvement Service Scotland and are working with a number of national charities such as the Scouts and NSPCC. We are working with the FCA Regtech sandbox in conjunction with global insurers. We are a registered BCorps and have set up a Guardians Council to hold us to account; as well as working with Responsible 100, Doteveryone Sustainable Tech Trust Mark Prototyping, and EU Compass Responsible Innovation to assist us in developing our ethics framework.