Spain fines Yoti €950,000 over biometric data violations

Spain’s data protection authority (AEPD) fined digital identity company Yoti €950,000 for unlawful processing of biometric data. The regulator found that the company failed to establish a valid legal basis under GDPR for processing facial recognition data used in its age verification services.

Authorities also criticized Yoti’s use of pre-ticked consent boxes for research purposes, stating that such practices do not meet GDPR requirements for freely given consent. The decision highlights growing scrutiny around biometric technologies and their classification as sensitive personal data.

‍