yoti Archives - Bredemarket

Yoti is the Latest Company to Pull Out of Spain

Yoti is leaving Spain.

In the last decade, Google pulled Google Noticias (Google News) out of Spain for eight years because of a dispute with the Spanish government.

Yoti is not quite as big as Google, but Yoti is leaving Spain also.

“Yoti is disappointed to announce that from 10th September, we will be removing the Yoti ID app from the Apple and Android app stores in Spain. Our decision has come about in light of our ongoing appeal through the Audiencia Nacional (Spanish High Court) against the decision of the Spanish Data Protection Agency (AEPD).”

Why? Because the AEPD insisted that Yoti provide a non-biometric alternative to access its own app. Yoti is fine with non-biometric alternatives to Yoti itself, but it won’t compromise on how its own app is accessed.

“However, to align with our understanding of the AEPD’s decision we would have to offer a non-biometric alternative, like a PIN, password, or SMS or email OTP. None of these authentication alternatives offer the same strong protection as biometric authentication. They can be easily shared, stolen or compromised….

“Biometric authentication is the cornerstone of the protections we offer to every Yoti ID app user globally. Without it, we would be unable to provide the same level of assurance to our Digital ID users or to the businesses and organisations that depend on Yoti to verify identities and ages accurately and securely. Maintaining that standard of protection is fundamental to who we are.”

So Yoti is bidding good-bye to Spain.

Third/Fourth Party Risk Management and Age Verification

Third party risk management, illustrated by a locked safe connected to a breached safe.

Let’s say a bar wants to check the ages of its patrons, but does not want to use the patron’s physical ID card (in my country, usually a driver’s license).

But a bar cannot perform digital age verification on its own. The bar has to contract with some other entity that knows how to do this.

This freaks some people out…massively.

“New cybersecurity research indicates that one of the world’s leading age verification providers collects and shares highly sensitive personal data—including facial photos and device fingerprints—with third parties.”

The research, conducted by the Georgia Institute of Technology and UC Irvine, focused on one of the big age verification vendors, Yoti.

“The research team determined that the process Yoti uses to verify a person’s age broadcasts the person’s personal information to third- and fourth-party companies….

“According to the researchers, the data is…sent to credit card companies, IP geolocation services, and data brokers. The researchers found that the information being shared can be used to identify and track devices. For example, a single verification attempt may transmit a user’s facial image, IP address, and device fingerprint to credit card companies.”

Yet to my knowledge the researchers did not propose an alternative.

Other than having each entity develop its own age verification system. Perhaps someone like Meta could do that, but Frank’s Bar certainly couldn’t.

Age verification is not unique in terms of data sharing. Third Party and Fourth Party Risk Management vendors encounter these issues all the time. And yes, sometimes companies that have other companies’ data are hacked. That’s why they use TPRM in the first place.

Image source: GET Group NA, https://apps.apple.com/us/app/get-mobile-verify/id1501552424.

And don’t forget that if you don’t use digital age verification, you’re going to use physical age verification, where the guy behind the bar learns EVERYTHING about you. I don’t think that’s necessarily better.

It’s time to think through the consequences of abandoning technology.

The May 6, 2026 List of PAD 3 Conforming Solutions

Update to the April 2 version. Added Shufti.

Vendor	Modality	Confirming Lab	Link/Date
Aware	Face	BixeLab	November 2025
BioID	Face	Tüvit	August 2025 (1) (2)
FaceTec	Face	BixeLab	October 2025
Incode	Face	iBeta	February 2026
Oz Forensics	Face	BixeLab	March 2026
Paravision	Face	Ingenium	September 2025
Shufti	Face	iBeta	April 2026
Yoti	Face	iBeta	January 2026

The April 2, 2026 List of PAD 3 Conforming Solutions

Update to the March 25 version. Added BioID.

Vendor	Modality	Confirming Lab	Link/Date
Aware	Face	BixeLab	November 2025
BioID	Face	Tüvit	August 2025 (1) (2)
FaceTec	Face	BixeLab	October 2025
Incode	Face	iBeta	February 2026
Oz Forensics	Face	BixeLab	March 2026
Paravision	Face	Ingenium	September 2025
Yoti	Face	iBeta	January 2026

I’m slowly finding these vendors. I won’t maintain this list forever, but as long as there are so few Level 3 solutions, I want to highlight them.

Coincidentally, I just reviewed an eBook by one of the vendors listed above, detailing things that you should seek in your liveness detection vendor.

The eBook listed several items.
To no one’s surprise, this particular vendor provided ALL of these items in its liveness detection solution.
Surprisingly, however, the vendor did NOT mention independent confirmation of PAD capabilities.

The March 25, 2026 List of PAD 3 Conforming Solutions

Update to the March 3 version. Added Oz Forensics.

Vendor	Modality	Confirming Lab	Link/Date
Aware	Face	BixeLab	November 2025
FaceTec	Face	BixeLab	October 2025
Incode	Face	iBeta	February 2026
Oz Forensics	Face	BixeLab	March 2026
Paravision	Face	Ingenium	September 2025
Yoti	Face	iBeta	January 2026

The March 3, 2026 List (Probably Still Inaccurate) of PAD 3 Conforming Solutions

Update to the February 27 version. Added Incode.

Vendor	Modality	Confirming Lab	Link/Date
Aware	Face	BixeLab	November 2025
FaceTec	Face	BixeLab	October 2025
Incode	Face	iBeta	February 2026
Paravision	Face	Ingenium	September 2025
Yoti	Face	iBeta	January 2026

The Latest, Probably Still Inaccurate, List of PAD 3 Conforming Solutions

I remember when I was working in Anaheim and keeping track of the latest BIPA lawsuits, back when you could count them on one hand…then on two hands…then there were too many.

I feel the same way about my previous attempts to track the vendors that offer solutions that conform to ISO 30107-3 Presentation Attack Detection Level 3. I thought I’d found them all, then I’d find another one.

So here’s my current (Friday afternoon) list of the PAD 3 conforming solutions.

Vendor	Modality	Confirming Lab	Link/Date
Aware	Face	BixeLab	November 2025
FaceTec	Face	BixeLab	October 2025
Paravision	Face	Ingenium	September 2025
Yoti	Face	iBeta	January 2026

While Google Gemini informed me that Veridas had also received Level 3 confirmation from iBeta, that turned out to be a hallucination. Veridas realizes the importance of Level 3, though, as do other selected vendors, so I suspect this table will be outdated soon.

Oh, and just to confuse things further, some of the other tests, such as CEN/TS 18099 injection attack detection tests, also may apply in some way to presentation attacks. Or maybe not. We’ll see.

Even More On Presentation Attack Detection Level 3

This morning’s post listed three companies with independently demonstrated conformance to ISO 30107-3 presentation attack detection level 3: Aware, FaceTec, and Yoti.

The independent evaluators were BixeLab and iBeta.

But Ingenium provides PAD level 3 conformance assessments also.

And Ingenium testified to Paravision’s conformance.

So that’s a total of four companies at PAD Level 3: Aware, FaceTec, Paravision, and Yoti.

Who else did I miss?

And I will revisit my earlier question. Will consumers perceive that THEIR data is valuable enough to warrant Level 3 liveness detection? And avoid the solutions with “only” Level 2 conformance?

Four companies (so far) are betting on it.

Yoti iBeta Confirmation of Presentation Attack Detection Level 3

We’ve talked about Levels 1 and 2 of iBeta’s confirmation that particular biometric implementations meet the requirements of ISO 30107-3. But now with Yoti’s confirmation, we can talk about iBeta Level 3.

From iBeta:

“The test method was to apply 1 bona fide subject presentation that alternated with 3 artefact presentations such that the presentation of each species consisted of 150 Presentation Attacks (PAs) and 50 bona fide presentations, or until 56 hours had passed per species. The results were displayed for the tester on the device as “Liveness check: Passed” for a successful attempt or “Liveness check: Failed” for an unsuccessful attempt.

“iBeta was not able to gain a liveness classification with the presentation attacks (PAs) on the Apple iPhone 16 Pro. With 150 PAs for each of 3 species, the total number of attacks was 450, and the overall Attack Presentation Classification Error Rate (APCER) was 0%. The Bona Fide Presentation Classification Error Rate (BPCER) was also calculated and may be found in the final report.

“Yoti Limited’s myface12122025 application and supporting backend components were tested by iBeta to the ISO 30107-3 Biometric Presentation Attack Detection Standard and found to be in compliance with Level 3.”