Biometric Update https://www.biometricupdate.com Biometrics News, Companies and Explainers Wed, 16 Sep 2026 14:19:56 +0000 en-US hourly 1 66434804 International Identity Day shifts focus beyond coverage to trust https://www.biometricupdate.com/202609/international-identity-day-shifts-focus-beyond-coverage-to-trust https://www.biometricupdate.com/202609/international-identity-day-shifts-focus-beyond-coverage-to-trust#respond Wed, 16 Sep 2026 13:29:27 +0000 https://www.biometricupdate.com/?p=355961 The ninth annual International Identity Day is being observed today under the theme “My Identity, My Shadow. Never Apart.”  This year’s campaign emphasizes the need for identity that remains useful, secure, and trusted throughout a person’s life, beyond registration and credential issuance.  ID4Africa Executive Chairman Dr. Joseph Atick says population coverage remains important but is no longer a sufficient measure of an identity system’s success. In a message for the observance, he asks whether an identity works for the individual and provides practical value in daily life. Atick says legal identity should be established from the beginning, remain useful throughout a person’s life, and be secure by design People should also know when their identity is accessed and have control over what information they share, with whom, and for what purpose, he says. Atick continues, “Trust is not created by technology alone. It is earned through strong institutions, effective safeguards, transparency, accountability.” The message reflects ID4Africa’s broader shift from enrollment targets to sustainable identity ecosystems. The latest World Bank ID4D Global Dataset estimates that 800 million people lack proof of legal identity, down from one billion in 2017. More than 400 million of them live in Sub-Saharan Africa. Approximately 450 million are children whose births were never registered. The World Bank estimates that 2.8 billion people lack access to a government recognized digital ID that can be used for online transactions. Having a digital ID also does not mean that it is being used. More than 70 percent of adults in Vietnam have one, but fewer than 20 percent have used it. The figures highlight different challenges: lacking proof of legal identity, lacking access to digital identity, and not using an available digital ID.  September 16 was selected because it corresponds to the UN Sustainable Development Goal 16.9 that seeks to provide legal identity for all, including birth registration, by 2030. ID4Africa launched the campaign at its annual meeting in Abuja in 2018. International Identity Day has not been designated as an official UN international day.  The campaign coalition has since grown to more than 400 partner organizations from governments, development agencies, civil society and the private sector. Nigeria, Namibia, Niger, Liberia and Madagascar have formally adopted September 16 as a National Day of Identity. Countries across Africa are commemorating Identity Day through national events, public outreach and community activities. Identity technology provider Veridos is among the companies supporting this year’s observance. CEO Bernd Kümmerle says trusted identity enables people to participate in society while protecting them from growing physical and digital threats. Atick’s message places that technology within a broader governance framework: identity systems must combine utility with institutional safeguards, transparency and accountability if they are to earn public trust. ]]> https://www.biometricupdate.com/202609/international-identity-day-shifts-focus-beyond-coverage-to-trust/feed 0 355961 24.4M Filipinos use national ID to open GCash accounts: PSA https://www.biometricupdate.com/202609/24-4m-filipinos-use-national-id-to-open-gcash-accounts-psa https://www.biometricupdate.com/202609/24-4m-filipinos-use-national-id-to-open-gcash-accounts-psa#respond Wed, 16 Sep 2026 12:48:51 +0000 https://www.biometricupdate.com/?p=355965 The Philippine Statistics Authority (PSA) says more than 24 million Filipinos have successfully verified their identities and opened e-wallet accounts through GCash, using their national ID. As of May, 61 percent of onboarded GCash users relied on their national ID in card, paper or digital ID form for account opening and verification. This is equivalent to 24.4 million Filipinos. PSA National Statistician Claire Dennis S. Mapa said the initiative ensures that “no Filipino gets left behind in the country’s digital transformation agenda just because they don’t have a government ID.” The partnership between PSA and GCash extends further with GCash becoming the first e‑wallet in the Philippines to integrate the PSAHelpline service. This allows users to request official civil registry documents like birth, marriage and death certificates, as well as CENOMAR and CENODEATH, directly through the app. These documents are issued in tamper‑proof PDF format, digitally signed by PSA and carry full legal weight. The documents are issued as cryptographically secured PDFs with the same legal validity as physical PSA certificates, and their authenticity can be verified electronically. Birth, death and marriage certificates cost ₱290 (US$4.61) each, while CENOMAR and CENODEATH certificates cost ₱345 ($5.49). Last year 18 million certificates were issued. Demand is expected to rise further with the new digital service. GCash users can access the PSAHelpline Mini App through the GLife section, streamlining the process from request to payment and delivery. Physical copies and door‑to‑door delivery remain available for those who prefer traditional formats, the PSA clarified. The collaboration builds on grassroots efforts such as PSA co‑location and GCash barangay outposts, which since July 2025 have enabled more than 2,000 residents across 25 communities to register for national IDs and open verified e‑wallet accounts. PSA registration officers noted that the popularity of GCash services has encouraged more citizens to register for IDs, bridging gaps in documentation that have historically excluded many from the formal financial system. Financial exclusion nevertheless remains substantial. The Bangko Sentral ng Pilipinas’ 2025 Consumer Finance and Inclusion Survey found that half of Filipino adults owned a formal financial account. Lack of documentation has historically been among the barriers to account ownership, giving the national ID a potentially important role in expanding access. By integrating national ID verification into widely used platforms like GCash, officials say millions of previously unbanked citizens can now participate in the digital economy. PSA has invited other financial institutions to partner with the national ID system to broaden its reach and strengthen the country’s digital identity infrastructure. “By making essential civil registry documents easier to access, we are helping more Filipinos participate in the digital economy and access the opportunities they deserve,” said Cleo Celeste Santos, GCash’s VP for Public Sector. The PSA will continue engaging with companies, schools and government agencies to ensure acceptance of digital certificates, Mapa added, to reinforce the legal and practical value of the national ID system in everyday transactions.]]> https://www.biometricupdate.com/202609/24-4m-filipinos-use-national-id-to-open-gcash-accounts-psa/feed 0 355965 Lindner brings inGo construction credentials to Germany’s d-you wallet https://www.biometricupdate.com/202609/lindner-brings-ingo-construction-credentials-to-germanys-d-you-wallet https://www.biometricupdate.com/202609/lindner-brings-ingo-construction-credentials-to-germanys-d-you-wallet#respond Wed, 16 Sep 2026 12:44:05 +0000 https://www.biometricupdate.com/?p=355975 Subcontractor management platform inGo will connect with Germany’s d-you digital identity wallet as part of launch partner Lindner Group’s participation in the program. The platform is already used on hundreds of construction sites and is being prepared for d-you’s January 2, 2027 launch. As a launch partner, inGo will integrate directly with the European Digital Identity (EUDI) Wallet framework. This will allow workers and subcontractors to provide verified digital certificates without re‑entering data, reducing paperwork and improving efficiency. At a partner roundtable in Berlin on September 9, Lindner Managing Director Martin Weber said inGo was built from everyday construction site needs. “That’s exactly where inGo was developed,” he said. “The mobile app brings together all documents, certificates, and legal requirements in one central place.” inGo was developed by Lindner Group subsidiary tibe.io to digitize compliance checks and subcontractor management. The app centralizes documents, certificates and legal requirements, replacing paper passes with QR codes and sending automated reminders when certificates are about to expire. Lindner reports more than 850 subcontractors and 1,200 projects are registered. “Looking ahead, the technology behind inGo is intended to be used not only in construction but in other industries as well,” Weber added. Branded d‑you, Germany’s digital wallet will allow citizens to store and use digital versions of IDs, driver’s licences and other documents on their smartphones. At launch, around 40 partners from business, science and public administration will provide services through the wallet. The services include age verification, legally binding contracts and online bank account opening. The app will be voluntary, free, and compliant with EU technical standards, storing data encrypted on the user’s device rather than in the cloud. The wallet is Germany’s implementation of the EU‑wide EUDI Wallet framework For Lindner, the integration shows how a tool developed for construction site compliance can become part of a broader European digital identity ecosystem. The company says it eventually plans to take the technology behind inGo into other industries.]]> https://www.biometricupdate.com/202609/lindner-brings-ingo-construction-credentials-to-germanys-d-you-wallet/feed 0 355975 Proof’s VDC launch brings together banking regulation, reusable identity and AI agents https://www.biometricupdate.com/202609/proofs-vdc-launch-brings-together-banking-regulation-reusable-identity-and-ai-agents https://www.biometricupdate.com/202609/proofs-vdc-launch-brings-together-banking-regulation-reusable-identity-and-ai-agents#respond Tue, 15 Sep 2026 23:15:23 +0000 https://www.biometricupdate.com/?p=355948 Proof, the identity and transaction-security company formerly known as Notarize, has launched its Verifiable Digital Credential, a portable digital identity that allows consumers to complete identity proofing once and reuse that verified identity across financial institutions and other organizations that accept Proof credentials. The VDC became generally available through Proof’s platform and API on September 15. The launch comes as three developments converge around reusable identity: U.S. regulators have given financial institutions clearer guidance for using verifiable digital credentials; Proof has an existing network of businesses where reusable identity could potentially gain utility; and AI agents are creating a new identity problem — proving not only who is behind an agent, but what that person authorized it to do. Together, those developments make the launch more than the introduction of another digital credential. They point toward a model in which verified identity can move between institutions — and potentially into transactions performed by AI agents on a person’s behalf. According to Proof, each credential is anchored to an individual X.509 certificate issued by its WebTrust-audited certificate authority following Kantara-certified IAL2 identity proofing. The credential is held by the consumer rather than belonging to an individual relying institution, allowing it to be presented again wherever Proof credentials are accepted. The significance of the launch becomes clearer when each of those three developments is considered separately.

Regulators give VDCs a clearer path into financial services

The first development happened just seven days before Proof’s announcement. On September 8, the Financial Crimes Enforcement Network, together with staff from the Federal Reserve, FDIC, NCUA and OCC, issued new and updated FAQs explaining how verifiable digital credentials can fit within existing Customer Identification Program requirements. The agencies addressed VDCs through two routes. Government-issued VDCs, such as mobile driver’s licenses (mDLs), may qualify as government-issued identification and therefore potentially be used as a documentary verification method when applicable CIP requirements are satisfied. Separately, regulators updated an existing FAQ covering electronic credentials to explicitly include VDCs alongside digital certificates as a potential non-documentary identity verification method. That guidance can include credentials issued and maintained by non-government third parties. That second route is particularly relevant to commercial credential issuers such as Proof. It does not amount to a regulatory endorsement of Proof or any other provider. Financial institutions remain responsible for ensuring that a third-party credential issuer uses an appropriate level of authentication. The guidance also does not change existing Bank Secrecy Act requirements or create new supervisory expectations. What has changed is that VDCs are now explicitly addressed within federal CIP guidance. Roger W. Ferguson Jr., former vice chairman of the Federal Reserve Board of Governors and a member of Proof’s board of directors, framed portable identity as both a consumer-experience and trust-infrastructure issue. “Portable digital identity has the potential to reduce friction for consumers while giving institutions stronger, independently verifiable evidence,” Ferguson said, adding that such systems require infrastructure built to standards expected of financial institutions. The regulatory clarification gives financial institutions greater clarity for evaluating an identity model that differs significantly from how most consumers prove who they are today.

From repeatedly verifying an ID to carrying an identity

Consider a consumer opening a checking account. They might upload a driver’s license, take a selfie and complete identity and fraud checks. Later, they apply for a credit card and potentially repeat the process. A mortgage can trigger another identity check. Opening an account or applying for another credit card at a different institution can start the process again. Each institution effectively establishes the person’s identity for itself, while copies of sensitive identity information can accumulate across organizations. “For decades, every institution has effectively rebuilt a person’s identity from scratch,” Proof founder and CEO Pat Kinsel said, describing the repeated cycle of document uploads, selfies and identity checks. Proof’s model is designed to change that architecture. After completing IAL2 identity proofing, Proof says the consumer receives a VDC anchored to a unique X.509 certificate bound to the verified identity. The credential is delivered to the consumer’s device and cryptographically bound to a hardware-protected key. The consumer can then present the credential again at an institution that accepts it rather than repeating the complete identity-proofing process. Proof says the service supports OpenID for Verifiable Credential Issuance (OID4VCI) and OpenID for Verifiable Presentations (OID4VP), allowing consumers either to enroll just in time or, if they already hold a Proof credential, reauthenticate and present their existing identity. Organizations do not have to preregister every user before receiving a credential. Proof says the credential can also be reused for interactions including wire authorizations, beneficiary changes and account recovery. The company supports revocation and live credential-status checks, allowing a relying institution to determine whether a credential remains valid. Using selective disclosure based on the SD-JWT verifiable credential format, Proof says consumers can provide only the identity attributes required for a particular decision rather than transmitting an entire identity document. The institution still determines whether it trusts and accepts the credential. That distinction is important. Reusable identity does not eliminate the relying institution’s responsibility to decide whom and what to trust. Instead, it changes the evidence available to make that decision.

Proof already has a network where reusable identity could expand

The second factor is distribution. A reusable credential has limited value if there is nowhere to reuse it. Proof says its identity infrastructure already serves more than 8,000 businesses across mortgage, auto, wealth, insurance and enterprise, and that more than $1 trillion in transactions have been secured across its platform. Those figures describe Proof’s broader business network. They do not mean that all 8,000 businesses currently accept Proof’s VDC. The company says individuals can claim a credential through Proof and use it with “participating organizations” across its network, but its announcement does not specify how many organizations currently accept the credential. Still, Proof enters the reusable-identity market with an existing base of business relationships into which the credential could potentially expand. The company has also spent 2026 building relationships and infrastructure around that strategy. In March, Proof announced a strategic partnership with IDEMIA Public Security. The companies said they planned to combine IDEMIA’s identity verification and authentication technologies with Proof’s PKI-based digital signature and authorization network to support privacy-preserving VDCs spanning physical, logical and digital environments. In May, Proof joined the FIDO Alliance, describing the move as part of its work connecting verified human identity with actions performed through AI agents. Then, in June, Proof launched x401, which the company describes as an open, issuer-neutral protocol for verifying the identity and authority behind AI agents. Taken together, the announcements show the direction of Proof’s strategy: not simply issuing a credential, but trying to establish infrastructure through which verified identity and authorization can be reused across different interactions.

AI agents introduce a new identity and authorization problem

The third development pushes the story beyond traditional customer onboarding. AI agents raise a different version of a familiar identity question. Imagine an agent receiving an instruction to open an account, move money or change a beneficiary. The institution receiving that request needs to answer two separate questions: Who is the human behind the agent, and did that person authorize this particular action? Proof is positioning its VDC and x401 architecture around that problem. The company says its VDC establishes the identity of the person, while its authorization infrastructure and x401 protocol are designed to carry that identity into agentic interactions and create cryptographic evidence connecting an agent’s action to the verified person and the authority granted to it. When Proof launched x401 in June, it described the protocol as issuer-neutral and designed to allow a website or API to request the particular evidence it requires from an agent — such as verified identity, age, membership, organizational affiliation, signing authority or proof of humanness. The agent can then present a compatible credential and authorization for the receiving service to evaluate. The architecture is Proof’s answer to an emerging problem, rather than evidence that the industry has settled on a particular approach to agent identity or authorization. But it illustrates why portable identity could become more relevant as transactions move beyond direct human-to-application interactions. A reusable credential could potentially serve two generations of digital transactions: reducing repeated identity proofing in today’s human-initiated interactions while providing one component of the trust infrastructure needed when software begins acting on a verified person’s behalf.

From identity checks to identity infrastructure

The convergence of these developments is what makes Proof’s launch notable. Regulatory clarity provides a pathway. Proof’s existing business network could provide distribution. And the rise of AI agents is creating new questions around how verified human identity and delegated authority can be carried into machine-initiated transactions. The immediate proposition is relatively straightforward. Instead of repeatedly uploading identity documents and completing identity proofing at every participating institution, a consumer verifies their identity once, receives cryptographically verifiable evidence of that identity and presents it again where the credential is accepted. But the longer-term implication is broader. Digital identity verification has largely operated as a point-in-time transaction: an institution asks who someone is and performs the checks necessary to answer that question. The result generally remains inside that institution. Reusable credentials begin to separate the verified identity from the institution that happens to need it at that moment. If financial institutions become comfortable accepting credentials issued by trusted third parties, identity verification could gradually shift from something every institution independently reconstructs toward a portable trust layer that consumers carry between financial relationships. And if AI agents increasingly transact on behalf of those consumers, that identity may eventually need to travel another step — from the verified human, through an authorized agent, to the institution receiving the instruction. Proof’s launch places the company at the intersection of those two shifts: making human identity reusable today and attempting to make that identity usable when machines act on humans’ behalf tomorrow.]]> https://www.biometricupdate.com/202609/proofs-vdc-launch-brings-together-banking-regulation-reusable-identity-and-ai-agents/feed 0 355948 Deal for cybersecurity lab expands Fime’s digital identity assurance portfolio https://www.biometricupdate.com/202609/deal-for-cybersecurity-lab-expands-fimes-digital-identity-assurance-portfolio https://www.biometricupdate.com/202609/deal-for-cybersecurity-lab-expands-fimes-digital-identity-assurance-portfolio#respond Tue, 15 Sep 2026 19:25:56 +0000 https://www.biometricupdate.com/?p=355887 The market around biometrics and digital identity testing has developed to the point where accredited labs and evaluation bodies are choosing strategic directions that differentiate them from their competition. In the latest example of this trend, Fime has acquired cybersecurity and compliance automation provider Red Alert Labs to advance its position as an overall digital trust provider. The acquisition brings cybersecurity evaluation, certification expertise and compliance automation capabilities to Fime’s established portfolio of payments, smart mobility and digital identity testing, according to the announcement. It also gives Fime access to Red Alert Labs’ Cyberpass compliance automation platform. Red Alert Labs is lending its expertise in AI compliance to the EU’s CERTAIN initiative as a consortium partner. Fime CEO Lionel Grosclaude notes the firms ambition to serve as a global digital trust provider. That means providing the trust infrastructure that enables digital ecosystems to scale. “For more than three decades, we have helped build trust in payments, and we have extended that expertise into digital identity and smart mobility,” Grosclaude says. “Cybersecurity is the next natural step. These markets are converging: customers increasingly need to prove not only that a product works and interoperates, but that it is secure, compliant and remains trustworthy throughout its lifecycle.” Red Alert Labs Founder and Managing Director Roland Atoui says the together with Fime it can offer continuous compliance readiness assessments, certification industrialization and enhance trust in digital identity, digital wallets and the ecosystems that are emerging around AI agents. He will continue to lead the lab, which continues operating as an independent entity, keeping its accreditations and autonomy. Fime’s steady expansion of its testing and trust assurance services includes the recent launch of a certification scheme for mDL-storing digital wallets and mDL readers.]]> https://www.biometricupdate.com/202609/deal-for-cybersecurity-lab-expands-fimes-digital-identity-assurance-portfolio/feed 0 355887 OSD granted patent for biometric barcode security and authentication https://www.biometricupdate.com/202609/osd-granted-patent-for-biometric-barcode-security-and-authentication https://www.biometricupdate.com/202609/osd-granted-patent-for-biometric-barcode-security-and-authentication#respond Tue, 15 Sep 2026 19:24:16 +0000 https://www.biometricupdate.com/?p=355925 A new European patent awarded to the Austrian State Printing Company (OSD) provides IP protection for a technology the company says could establish a new standard for securing the data included on identity documents. The patent granted for “Securing and Authenticating of a Personal Identity Document” describes a process to protect identity data with the company’s “Open Secure Document Biometric Barcode” for physical IDs. The process brings together biometrics and a QR code through open ledger technology. The publication of the patent in the European Patent Bulletin gives it international validity. A control code is generated by applying a hash function to the payload data, which must be matched to access the identity data. OSD points out that verification of chip-based ID documents that rely on NFC can be hampered by connection errors or physical wear-and-tear on the documents. OSD therefore suggests using a “digital security seal” either as an alternative or complement to the chip-based functionality of Machine Readable Travel Documents (MRTDs). The biometric barcode technology can further be used to protect the foundational ID documents, or “breeder” documents like citizenship or birth certificates that are typically used in the issuance of passports and other identity documents. OSD says its technology also protects against future risks like data harvesting and subsequent decryption by quantum computers, the company says. “With the granting of this patent, OSD underscores its position as a global pioneer in the field of high-security technology and sets new standards for the protection of sensitive data,” explains OSD Director General Helmut Lackner. “Modern technologies ‘made in Austria’ not only protect citizens’ sensitive personal data but also ensure technological independence and sovereignty in uncertain times.” OSD provides identity services to countries around the world, including an integration of Liberia’s national ID and civil registry, and issuance of biometric ID cards in Nigeria for travel in the ECOWAS region.]]> https://www.biometricupdate.com/202609/osd-granted-patent-for-biometric-barcode-security-and-authentication/feed 0 355925 UK pubs can legally accept digital ID for age assurance; now, implementation begins https://www.biometricupdate.com/202609/uk-pubs-can-legally-accept-digital-id-for-age-assurance-now-implementation-begins https://www.biometricupdate.com/202609/uk-pubs-can-legally-accept-digital-id-for-age-assurance-now-implementation-begins#respond Tue, 15 Sep 2026 18:59:11 +0000 https://www.biometricupdate.com/?p=355904 The UK government has made it official: licensed premises across England and Wales will now have the option to accept digital proof of age for alcohol sales. The draft Licensing Act 2003 (Mandatory Licensing Conditions) (Amendment) Order 2026 has been approved by both the House of Commons and the House of Lords. Which is to say, the amendments to the mandatory licensing conditions for alcohol sales are now in force, and certified digital ID is a valid option for age assurance in pubs, bars, restaurants, shops and other licensed premises. Finally, the government’s promise of Christmastime pints bought using digital ID for age checks is coming to pass. “Pubs, bars, restaurants, music venues and other licensed premises across England and Wales will have the choice to introduce digital proof of age for alcohol sales under new rules coming into force today,” says the release. It quotes Digital Government Minister Stephanie Peacock, who says the “groundbreaking” change “will mean you do not need to carry a physical ID, nor hand over sensitive personal information such as your name or address just to prove your age – allowing everyone to feel safer on a night out.” There is one small caveat, expressed in the caution that “it will take businesses time to widely adopt and accept digital proof-of-age.” Put another way, the system is in no way actually ready for action: the law may allow digital ID for buying hooch, but for now most places don’t have the training, partners and infrastructure needed to accept them. The reality of the change will unfold as part of the larger shift to digital ID and credentials, as businesses respond to legislative change, customer demand and generational shifts.

For Luciditi and other certified DVS providers, hard work begins

UK biometrics providers, however, have been preparing for some time. Only digital IDs provided by firms certified against the Digital Verification Services (DVS) trust framework are valid in the UK system. DVSPs must operate a currently certified Orchestration Service, with which a license holder must have an agreement in place prior to accepting digital ID. Luckily, a number of leading providers have already laid the foundations for the ecosystem. Currently, the UK DVS register lists 46 providers. Among those certified for orchestration, Luciditi and Yoti have worked on a partnership to allow interoperability between their products (along with Post Office EasyID), to help drive adoption of what could be a game-changing shift in how identity functions as proof of age. In a post on Luciditi’s website, CTO Philip Young says that “allowing individuals to use certified digital IDs for alcohol sales is a practical, modern change that will make life easier for consumers and safer for front-line staff.” “Whichever digital ID someone chooses, they now have a secure digital option that protects their privacy. With Luciditi Verification Services already present in point of sale systems and assistive challenge 25 technologies, we’re helping all kinds of licensed premises reduce conflict, improve compliance, and deliver a smoother customer journey.” Young notes that licensees are not obliged to accept digital ID; they can choose to require physical ID. And he expands on the government’s buried proviso on timing, acknowledging that “it will take time for a critical mass of licensed premises to get hold of the technology so that it becomes ubiquitous.” That said, he predicts that “things will likely look very different by this time next year!”

Yoti announces partnerships with four UK point of sale providers

Yoti, which has been gearing up for the change in laws for more than a decade, today announced new partnerships with Diebold Nixdorf, Flooid, StrongPoint Kestronics and Zebra Technologies, all of which provide point of sale and self-checkout technology to the UK’s leading supermarkets, retail and hospitality businesses. Per a release from the company, “through their partnerships with Yoti, the technology partners and retailers will integrate digital ID checks into their existing point of sale and self-checkout systems, making it easier for licensed businesses already using their technology to begin accepting digital proof of age.” Yoti also offers a free ID Checker mobile and web app and a partnership with Licensing Connect, to make it easier for small businesses to check that a customer’s digital proof of age is authentic and valid. The company says more than 15,000 businesses downloaded the ID Checker app ahead of the change in law, “meaning many premises can start accepting Yoti ID and Post Office EasyID for alcohol sales from today.” Robin Tombs, CEO of Yoti, calls the change “a landmark moment for digital identity in the UK.” “We’ve been working towards this moment since Yoti was founded in 2014 and we’re delighted to work with leading technology providers including Diebold Nixdorf, Flooid, StrongPoint, Kestronics and Zebra Technologies to make it simple for businesses to start accepting digital proof of age.” Yoti’s group product manager, Emily Hyett, recently joined the Biometric Update Podcast to discuss how Yoti’s digital ID works, what customers can expect and what providers can do to help support broad adoption.

TOTUM to launch digital proof of age product for students

More specialized companies are also making changes in the wake of the new law. A release from TOTUM, a member benefits and ID platform for students, apprentices and professionals, says it is preparing the launch of its own digital proof of age solution, building on its TOTUM+ PASS card. Simon Wild, head of marketing at TOTUM, says its PASS+ card “has already given millions of students a trusted way to verify their age,” and says the company is “excited to bring that same reliability to a digital format that fits straight into their phone.”]]> https://www.biometricupdate.com/202609/uk-pubs-can-legally-accept-digital-id-for-age-assurance-now-implementation-begins/feed 0 355904 From data residency to key sovereignty: Thales launches UK cloud HSM https://www.biometricupdate.com/202609/from-data-residency-to-key-sovereignty-thales-launches-uk-cloud-hsm https://www.biometricupdate.com/202609/from-data-residency-to-key-sovereignty-thales-launches-uk-cloud-hsm#respond Tue, 15 Sep 2026 18:55:33 +0000 https://www.biometricupdate.com/?p=355811 French technology and cybersecurity group Thales has launched a UK-hosted version of its Luna Cloud HSM, allowing organizations to consume hardware security module (HSM) capabilities as a cloud service while keeping the full lifecycle of their cryptographic keys within the UK. Announced on September 14, the service addresses a growing consideration for organizations moving sensitive systems to the cloud: keeping data in the UK may not be enough if the cryptographic keys protecting that data are managed elsewhere.

From dedicated HSMs to HSM as a service

Traditionally, organizations requiring greater control over cryptographic keys could deploy and manage their own HSM hardware. That provides control, but also brings the cost and complexity of installing, maintaining and scaling specialized infrastructure. Thales’ Luna Cloud HSM provides those capabilities as a service through its cloud marketplace for cryptographic and data-protection services. The marketplace, called Data Protection on Demand (DPoD), allows organizations to consume cryptographic capabilities without buying and managing the underlying HSM infrastructure themselves. For UK customers, the important part is localization. Thales says cryptographic keys will be generated, stored, used, backed up and destroyed within the UK. Two UK-based DPoD instances will also provide high availability and disaster recovery within the country. “Cloud adoption has moved beyond questions of where services are hosted,” said Paul Hampton, Data Protection Cloud Services Owner at Thales. Organizations increasingly need to know who controls the cryptographic keys protecting their applications, identities and data, he added.

Cloud HSM is not new

Thales is not the only provider addressing this. Microsoft Azure, AWS and Google Cloud all offer HSM or key-management services that can operate within specific regions, including the UK. But their native services are primarily tied to their respective cloud environments. Thales’ model, delivered independently of any single hyperscaler, allows organizations to separate their choice of cryptographic infrastructure from the cloud hosting their applications and data. That distinction could matter most to customers concerned about dependence on a foreign-headquartered cloud provider — the same broader jurisdictional concern underlying recent European technology decisions.

Data residency does not solve the entire sovereignty problem

Keeping sensitive data in a UK data center addresses data residency. But organizations must also consider who controls the cryptographic keys that provide access to encrypted information. Where are those keys stored? Who can access them? Where are backups maintained? Which jurisdiction applies to the infrastructure provider? These questions are particularly relevant for digital identity, where cryptographic keys underpin credential signing, authentication, encryption and trusted transactions. Thales’ proposition therefore combines two requirements: consuming cryptographic infrastructure as a cloud service while maintaining domestic control over the keys protecting sensitive systems.

Sovereignty concerns are already affecting technology decisions

Recent European cases show that these concerns can influence major technology and investment decisions. The Dutch government blocked U.S.-based Kyndryl’s proposed acquisition of Dutch cloud provider Solvinity earlier this year. Solvinity supports infrastructure behind DigiD, the Netherlands’ national authentication system, raising concerns about critical digital infrastructure coming under the control of a U.S. parent company. Switzerland faced a related controversy over plans involving AWS infrastructure for its national electronic identity ecosystem, highlighting concerns about relying on foreign-controlled infrastructure for sensitive government systems. The cases demonstrate why physical data residency is increasingly being separated from technological control. Encryption can reduce exposure when an infrastructure provider cannot decrypt customer data, but that moves the sovereignty question one level deeper: who controls the keys?

Independent validation adds another layer of assurance

Thales points to both FIPS 140 validation and SOC 2 compliance for its Luna HSM technology and cloud services. Under the NIST-led Cryptographic Module Validation Program (CMVP), cryptographic modules are tested against FIPS requirements by accredited independent laboratories before their results are reviewed and validated by the program. SOC 2 provides additional independent assurance around controls governing areas such as security and availability. For regulated and government customers, these assessments provide evidence beyond the vendor’s own claims about the infrastructure protecting their cryptographic keys. The technology is also already being applied to digital identity infrastructure. Earlier this year, Thales and Ubiqu integrated Luna HSMs into a remote secure element for the EUDI Wallet, where the HSM provides the protected environment for cryptographic keys and operations. The solution is designed to meet eIDAS High requirements and support post-quantum cryptography.

Why now?

More sensitive workloads are moving to the cloud, bringing government systems, financial services, telecommunications and digital identity infrastructure into the migration conversation. At the same time, sovereignty requirements are expanding beyond the location of data toward questions of ownership, jurisdiction and cryptographic control. Another transition is approaching: post-quantum cryptography. Organizations are beginning to prepare cryptographic infrastructure for algorithms designed to withstand future attacks from quantum computers. Thales positions the UK-hosted service as a crypto-agile foundation for that transition, allowing organizations to adapt their cryptographic infrastructure as standards and requirements evolve. Thales’ own research, conducted by S&P Global Market Intelligence, found that 36 percent of respondents considered strong encryption and key management sufficient protection for their sovereignty objectives regardless of physical location. That points to two approaches emerging around sovereign cloud: localize the infrastructure, or retain cryptographic control over the data even when infrastructure crosses borders. The UK-hosted Luna service combines elements of both.

Broader implications for the industry

Thales’ UK launch reflects two broader shifts in cloud infrastructure. First, data sovereignty is expanding beyond where data is stored. Governments and regulated organizations increasingly have to consider who controls their cloud infrastructure, cryptographic keys, backups and other technology supporting sensitive applications. Second, the infrastructure protecting those keys is itself moving to the cloud. HSMs have traditionally been specialized appliances organizations purchased, installed and operated. They are increasingly becoming infrastructure that can be consumed as a service. For governments and regulated enterprises, this creates a new balance between infrastructure ownership and infrastructure control. Organizations may not need to physically own every component if they can retain sufficient control over their keys, determine where they are managed and meet domestic resilience and governance requirements. The post-quantum transition could further accelerate that shift. Crypto-agile services may make it easier for organizations to change algorithms and security policies as cryptographic standards evolve without replacing individually managed hardware across their infrastructure. For cloud and security providers, local HSM and key-management infrastructure could therefore become an increasingly important part of sovereign cloud offerings as more sensitive government, financial and identity workloads move to the cloud. Thales’ UK expansion suggests the next phase of cloud sovereignty will be determined not only by where data resides, but also by who controls the cryptographic infrastructure protecting it.]]> https://www.biometricupdate.com/202609/from-data-residency-to-key-sovereignty-thales-launches-uk-cloud-hsm/feed 0 355811 EU to propose tiered social media age restrictions for under-15s https://www.biometricupdate.com/202609/eu-to-propose-tiered-social-media-age-restrictions-for-under-15s https://www.biometricupdate.com/202609/eu-to-propose-tiered-social-media-age-restrictions-for-under-15s#respond Tue, 15 Sep 2026 18:47:50 +0000 https://www.biometricupdate.com/?p=355883 The governing body of the European Union is moving ahead on a proposal to set a minimum legal age of 15 for using social media platforms. Politico reports that the European Commission will propose new rules to limit access to social media and video-sharing platforms for those under 15 years of age. Expected Thursday, the EU KIDS Act will establish age restrictions, but also include requirements for safety by design. The proposal “aims to create a tiered system for accessing social media under parental supervision before age 15,” wherein content is progressively accessible at different ages, and there are limits on contact with strangers and screen times. The accompanying new enforcement architecture follows the models of the Digital Services Act and the Artificial Intelligence Act, including supervisory fees to be paid by the highest-risk companies, intended to cover the costs of enforcement.

Proposal answers Macron’s call

European Commission President Ursula von der Leyen has been a vocal advocate for online safety laws and age assurance requirements for social media platforms, and began facing more pressure to act on a bloc-wide solution after France’s national law covering social media was put on hold by a Constitutional Council over free speech concerns. French President Emmanuel Macron, in particular, urged von der Leyen to pursue a unified position across member states on a minimum age for social media, as Austria, Denmark, France, Greece and Spain all pursue laws at the national level, creating the possibility for fragmented regulations across the bloc. The Commission has encouraged EU member states to adopt its white-label age verification app, but the incoming EU Digital Identity Wallet (EUDI Wallet) program looks likely to reorient the sector towards a wallet-based model – albeit slowly.

Regulations also target AI chatbots, video game platforms

TikTok, Instagram, X and other large social media platforms have become regulatory targets due to rising concerns from parents, educators and kids themselves about the potential mental health risks the platforms present for kids. Meta has faced major legal consequences in the U.S. over how its platforms have failed to protect minors. New studies are emerging showing a correlation between short-form video consumption and negative cognitive changes. However, while social platforms have become the biggest targets, they are not the only services to face the regulator’s whip. The EU’s proposal also applies to video-sharing platforms, online games (they’re looking at you, Roblox), AI chatbots and AI companions. Per the report, the text is still subject to change ahead of its formal presentation on Thursday and will have to be negotiated with European governments and members of the European Parliament afterward. Von der Leyen is expected to present more details in her State of the European Union speech to parliament members in Strasbourg on Wednesday.]]> https://www.biometricupdate.com/202609/eu-to-propose-tiered-social-media-age-restrictions-for-under-15s/feed 0 355883 Google rolls out age inference in Canada https://www.biometricupdate.com/202609/google-rolls-out-age-inference-in-canada https://www.biometricupdate.com/202609/google-rolls-out-age-inference-in-canada#respond Tue, 15 Sep 2026 18:45:42 +0000 https://www.biometricupdate.com/?p=355936 Google is trying out an age assurance strategy in Canada for its YouTube platform. However, it has opted not for privacy preserving age assurance technology certified against international standards – but rather for its own machine learning-based age profiling system. Google calls it “age estimation,” though it is more properly classified as age inference, and even then only tenuously; ISO/IEC 27566-1, which covers age assurance systems, specifies that true age inference must be “based on verified information.” Google’s system uses machine learning to “interpret a variety of signals already associated with a user’s account, such as the types of information a user has searched for or the categories of videos they’ve watched on YouTube. These signals help us determine whether a user is likely over or under the age of 18.” In a post, the company will automatically apply age-appropriate protections for users it determines to be under 18, including “Digital Wellbeing tools” such as “reminders to take a break and go to bed”;  disabling personalized ads and restricting age-sensitive ad categories; and blocking minors from accessing apps restricted to adults on Google Play. However, this method does not offer a conclusion based on what most would consider “verified information.” Google’s analysis of search and watch histories does not offer the same certainty as a verified database – and in one not-so-dim light, this looks like just another opportunity for Google to collect more data about its users. Being geared toward a Canadian audience, Google’s statement is deferential, polite and friendly. It insists its profiling tech was designed with user privacy in mind: “it minimizes the need to collect additional data and ensures we are not sharing granular user information with apps and websites unnecessarily.” However, it cannot resist casting a little shade at regulators in general – nor spreading the liability around for everyone to share. “While some would like a system that imposes a universal arbiter of age,” it says, “we believe that liability and responsibility rest with every service owner – the developer, the publisher, the app creator – because they know their users and services best.” Notably, users who believe they have been incorrectly identified as underage can appeal by perfoming age verifciation by uploading a photo of their government ID or a selfie.  The company does not specify if it performs this verification process in-house, or outsources it to a third party provider. Google’s ML-based system has been implemented in the U.S., where a petition calling on YouTube to turn it off accrued 100,000 signatures. In July of 2025, the company said it had “used this approach in other markets for some time.” The company also pointed to the would-be inference system when it was trying to argue its way out of being included in Australia’s Social Media Minimum Age Act. That effort also involved enlisting beloved children’s entertainers The Wiggles to shout down the age assurance law. That said, it has been proactive in rolling out its Play Age Signals API, which uses an age range declared by an adult at the time of device registration to curate and limit content for age-appropriate experiences. Canada recently tabled legislation that would see it follow Australia, the UK and Europe in imposing age restrictions on social media platforms and put protections on AI chatbots.]]> https://www.biometricupdate.com/202609/google-rolls-out-age-inference-in-canada/feed 0 355936