fineConcluded€950,000
Agencia Española de Protección de Datos (AEPD) — Yoti Ltd.
November 23, 2025 · Spain · Digital Identity and Age Verification
The AEPD fined Yoti for violations related to the handling of biometric data in its digital identity app, including unlawful processing of biometric data, invalid consent mechanisms, and excessive data retention. Yoti was also ordered to implement corrective measures.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.