Age Verification System for PlayStation and Meta Raises Privacy Concerns

Yoti, the age verification software utilized by around 60% of websites and services requiring age checks, including platforms like PlayStation, Meta, and TikTok, has come under scrutiny for allegedly gathering extensive private information beyond what’s necessary for age verification. This information is reportedly shared with several less visible third parties, as highlighted in a recent study from the Georgia Institute of Technology and the University of California.

The report, titled “Papers, Please: A First Look at Age Verification on the Web,” was presented at the IEEE Symposium on Security and Privacy conference on May 18. It raises significant concerns about Yoti’s data collection practices, suggesting they compromise user privacy and the overall effectiveness of age verification.

Yoti’s software reportedly collects a wealth of high-resolution data about users’ devices during the verification process, even though this data doesn’t seem essential for determining age. This includes details like OS version strings, available RAM, connection type, and CPU architecture. Such uniquely identifiable information could potentially enable unauthorized tracking of users’ devices.

The most alarming finding is that Yoti shares sensitive user information with several less visible third parties, including the payment processor Stripe. The report indicates that Stripe collects substantial telemetry that could be used to uniquely identify a device, including data scraped from the first-party website verifying the user’s age through Yoti. The study concludes that Yoti collects significant private information beyond what is necessary for age verification, including detailed browser and device metadata.

Since the report’s release, the researchers have noted that Yoti claims to have resolved the issue regarding Stripe accessing the first-party website. However, the researchers were unable to verify this assertion.

This situation raises further concerns. Yoti referring to the issue as a “bug” does not inspire confidence in the software, leading to questions about how securely user data is managed. Additionally, it remains unclear whether the data shared with Stripe has been retained.