Agencia Española de Protección de Datos (AEPD) — Yoti Ltd.
The AEPD fined Yoti for violations related to the handling of biometric data in its digital identity app, including unlawful processing of biometric data, invalid consent mechanisms, and excessive data retention. Yoti was also ordered to implement corrective measures.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the decision on 2026-09-06. Every holding carries a short verbatim quote from that text (in ES, the document's language).
- Decided by
- Agencia Española de Protección de Datos
- Parties
- Agencia Española de Protección de Datos v. YOTI LTD
- Remedy
- Yoti Ltd. was ordered to pay a total fine of 950,000 EUR and required to bring its biometric data processing, consent mechanisms, and data retention periods into compliance with the GDPR within six months.
- Amount
- €950,000
- Appeal
- Appeal status not stated
Key holdings
Yoti Ltd. unlawfully processed special categories of data by handling facial biometric templates without establishing a valid legal exception under Article 9 of the GDPR.
“YOTI estaría realizando un tratamiento de datos biométricos, considerados categorías especiales de datos para el que no acredita que concurra alguna de las circunstancias previstas” — Página 50, Sección V
Obtaining consent through pre-ticked default checkboxes for research and development or analytics fails to satisfy GDPR requirements for freely given and specific consent.
“los consentimientos realizados mediante casilla declarativas activadas por defecto no son el resultado de un acto afirmativo y claro que refleje una manifestación de voluntad libre, específica, informada, e inequívoca.” — Página 54, Sección VI
Yoti Ltd. breached the storage limitation principle by retaining personal data longer than necessary for the underlying verification purposes.
“YOTI conserva datos personales que exceden, con mucho, la finalidad para que los datos son tratados.” — Página 62, Sección XI
In plain English
The Spanish Data Protection Agency investigated Yoti Ltd., a provider of digital identity and age verification services. The agency examined how Yoti processes user data through its mobile application and software tools, particularly focusing on biometric processing and children's data. The authority found multiple violations of data protection rules. First, Yoti processed special categories of data, specifically facial biometric templates, without establishing a valid legal exception. Second, Yoti collected user consent using pre-ticked default checkboxes for internal research and development as well as analytics, which fails the requirement for freely given and specific consent. Third, Yoti infringed storage limitation principles by retaining personal data well beyond the necessary duration. Account data was retained for 3 years of inactivity, geolocation data was stored for 5 years, manual verification documents were kept for 28 days, and video recordings were retained for 30 days after verification. Consequently, the authority imposed a total fine of 950,000 euros on Yoti Ltd., comprising 500,000 euros for processing biometric data without a legal basis, 200,000 euros for invalid consent, and 250,000 euros for excessive data retention. Additionally, Yoti was ordered to bring its data processing operations into full compliance within six months. This decision highlights strict enforcement regarding biometric verification tools and default consent settings.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.