Spain’s data protection authority, the AEPD, has fined UK-based digital identity company Yoti 950,000 euros for violations of the EU’s General Data Protection Regulation related to its digital ID app. The ruling covers three separate GDPR infractions and includes a six-month corrective action deadline.
The investigation, initiated in December 2023 after the AEPD identified practices that could constitute possible infringements, focused on how Yoti processes biometric data during account setup, handles user consent, and retains personal data. Yoti, a London-based digital identity provider, offers age assurance and identity verification services across social media, financial services, and other sectors. Its total revenue since inception stood at just over 15 million euros as of March 2025, according to the AEPD judgment.
The largest component of the fine, 500,000 euros, relates to GDPR Article 9, which governs processing of special category data. Biometrics used to “uniquely identify a natural person” fall into that category. During account setup, the Yoti app compares a live selfie to a stored biometric template. The AEPD rejected Yoti’s position that this process constitutes authentication rather than unique identification, finding that Yoti lacked a lawful basis to process biometric data in this way.
The 200,000 euro consent violation under Article 7 stems from two design issues: users can click past the app’s privacy policy screen without opening or reading it, and the app defaults to consent for the use of biometric data in research and development without an affirmative opt-in.
The 250,000 euro retention violation under Article 5.1(e) covers several practices the AEPD found excessive. Geolocation data used to determine applicable age restrictions is retained for five years. Video recordings used in liveness detection are kept for 30 days. The AEPD also objected to Yoti retaining fraudulent ID documents beyond their original purpose, to train its verification algorithms.
The AEPD has shown increasing enforcement appetite in biometric cases. The regulator previously fined Spanish airport operator Aena in connection with its biometric boarding program.
Yoti rejected the ruling in firm terms and said it has begun an appeal to the Spanish High Court. The company stated that no user data was breached or compromised, and confirmed the ruling applies to the Yoti Digital ID app only. Yoti has six months to demonstrate to the AEPD that its biometric data processing, consent mechanisms, and data retention practices comply with GDPR.
Sources: AEPD
–
By the ID Tech Editorial Team
