UK Age Check Index

Yoti

Yoti Ltd, headquartered in GB. Website: yoti.com. Methods offered: facial age estimation (face scan), photo id, digital id wallet, reusable digital id.

verified 6 September 2026

Retention, as published by Yoti

“Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”

Quoted from yoti.com, dated July 2025; checked 6 September 2026. Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity.

Accuracy claims, as published

Vendor default versus deployer configuration

The same vendor's retention is often stated differently by each service that deploys it. Both are shown, dated. Where the rows differ, the difference is the fact; this site does not decide which is right.

DeploymentMethodWhat the deployment statesWhat Yoti states
OnlyFans adult Facial age estimation (face scan)
Secondary source (press)

No published retention period found (checked 6 September 2026).

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
PlayStation Mobile operator check
Primary source

No published retention period found (checked 6 September 2026).

Notes: Mobile contract check.

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
PlayStation Facial age estimation (face scan)
Primary source
“Yoti deletes your facial geometry data as soon as your verification is complete. PlayStation never collects, stores, or otherwise processes your facial geometry data.”

Quoted from playstation.com, dated 1 June 2026; checked 6 September 2026. Held by the vendor. Period as stated: immediately.

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
PlayStation Photo ID
Primary source

No published retention period found (checked 6 September 2026).

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
Spotify Facial age estimation (face scan)
Primary source
“After the age assurance process is complete, Yoti will delete all the user's data.”

Quoted from spotify.com; checked 6 September 2026. Held by the vendor. Period as stated: after check.

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
Spotify Photo ID
Primary source

No published retention period found (checked 6 September 2026).

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
Xbox Photo ID
Primary source
“The information players provide is protected with industry-standard encryption and is not stored or used for any other purpose.”

Quoted from news.xbox.com, dated 28 July 2025; checked 6 September 2026. Held by the service. Period as stated: not stored.

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
Xbox Facial age estimation (face scan)
Primary source

No published retention period found (checked 6 September 2026).

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
Xbox Mobile operator check
Primary source

No published retention period found (checked 6 September 2026).

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026
Xbox Credit card
Primary source

No published retention period found (checked 6 September 2026).

 “Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes.”
Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity
checked 6 September 2026

Reported customers

Certifications

The UK Age Check Certification Scheme (ACCS) registry lists certificates with their expiry dates; a certificate that has lapsed is recorded as such once the registry shows it.

Regulator actions and published incidents

Regulators

Questions people ask about Yoti

What does Yoti say it keeps?

"Images are not stored, shared, re-used or sold on. Images are immediately and permanently deleted… we do not use them for our own learning or training purposes." (yoti.com, dated July 2025; checked 6 September 2026). Period as stated: immediately (age estimation); Yoti app account data used for training with consent, deleted after 3 years of inactivity. Deployers can configure a different period; the vendor page shows each deployment's own wording beside this.

Is Yoti certified?

Recorded certifications: ISO 27001, ISO 27701, SOC 2 Type II, PAS 1296:2018. Each links to its source on the page; expiry dates are as stated there.

Has Yoti been fined or had a data incident?

ICO, May 2022: Regulatory Sandbox exit report AEPD (Spain), 25 March 2026: €950,000 fine: €500k unlawful biometric processing, €200k invalid consent, €250k excessive retention. Yoti rejects the decision; appeal pending.

Which UK services use Yoti?

Recorded deployments: OnlyFans, PlayStation, Spotify and Xbox. Also reported: Instagram.

Sources for this profile

Changes to this profile

Created 6 September 2026 from the research handover; no changes since.

All changes · RSS

Correct this entry

Vendors are welcome to correct their profile. Point us at the policy page and the wording is replaced with the quotation, dated. Send a correction. Nothing you send is published.