What changed on 15 September 2026
They’re starting with the pints. From 15 September 2026, licensed premises in England and Wales may accept digital proof of age through certified Digital Verification Services. The government specifically names Yoti and Post Office EasyID. The legal drinking age has not changed, but a phone-based identity credential is now legally acceptable at the bar.
The change was made through the Licensing Act 2003 (Mandatory Licensing Conditions) (Amendment) Order 2026. Digital ID is permitted only where the provider is certified, registered on the government’s DVS register and capable of verifying both the customer’s age and ownership of the credential. The Order applies to England and Wales, not Scotland or Northern Ireland.
What the app actually processes
Physical documents remain valid. Pubs and shops do not have to accept digital ID, and customers are not required by the alcohol rules to download an app. The government describes the change as an additional option alongside existing physical checks. That is the legal position today. It is not the same thing as saying the identity infrastructure is insignificant or temporary.
In a typical Yoti flow, the customer sets up the app in advance using approved identity documents and a facial image or selfie. At the point of sale, the app can authenticate the user and generate a temporary QR code. Yoti’s technical documentation says its proof-of-age QR codes are valid for 30 seconds, a short window intended to stop someone borrowing another person’s phone.
The retailer should not simply look at a screenshot. The code must be checked electronically through a registered verification service. The government’s guidance says the retailer will generally need confirmation that the customer is old enough and is the rightful holder of the digital proof. That is narrower than handing over a passport showing a name, date of birth and address.
The infrastructure behind the pint
But the privacy claim needs to be stated precisely. “The bartender does not see your address” is not the same as “no personal data is processed”. Yoti’s published age-verification policy says that an identity-document route can involve uploading an ID document and selfie. Where additional security is requested, the selfie may be compared with the photograph on the document using face-matching technology.
Yoti’s app privacy notice says a face scan or biometric template is used to secure the account and that the app does not work without biometric consent. It also lists account photos, face-scan images or video, ID-document portraits, month and year of birth, gender where available and phone movement measurements among data that may be processed for internal research and development. Users can opt out of that research use in the app settings.
From alcohol to online access, vapes and tobacco
Yoti says it does not sell users’ information. Its policy also says data may be shared with trusted service providers, fraud-prevention bodies, law enforcement or other authorities where legally required. Its age-verification policy says results may be retained for six months by Yoti on behalf of a client unless deleted sooner, while clients may retain results for longer. The exact data flow depends on the product, the provider and the relying business.
The alcohol rule is therefore not an isolated pub experiment. It relies on the statutory framework created by Part 2 of the Data (Use and Access) Act 2025. That Act provides for a government DVS trust framework, a public register of certified providers and supplementary codes for particular sectors and use cases.
The Act also creates an information gateway through which public authorities may disclose personal information to registered providers for identity and eligibility checks. The government’s DVS register is already operating and listed 63 certified services or providers on 16 September 2026. The system is not hypothetical, even though the government says its use remains voluntary in many contexts.
Why “voluntary” may not stay voluntary in practice
The national digital-ID scheme may have been cancelled, but the underlying rails have not disappeared. The government confirmed on 8 September that the national Digital ID programme announced in 2025 had been cancelled. It also confirmed that GOV.UK One Login, GOV.UK Wallet and the statutory DVS framework would continue, with digital identity policy moved to the Department for Digital, Culture, Media and Sport.
The same broad verification market is already being used online. Under the Online Safety Act, platforms carrying pornography must use highly effective age assurance. Ofcom lists digital identity services, photo-ID matching, facial age estimation, open banking, credit-card checks and mobile-network checks as possible methods. Ofcom also acknowledges that all age-assurance systems process personal data and that privacy compliance has been an area where services have fallen short.
The constitutional point, stated accurately
Further restrictions are planned. The government says regulations are expected to restrict certain social-media services for under-16s from spring 2027, alongside stronger age checks. The Tobacco and Vapes Act 2026 also gives ministers power to specify age-verification steps, including digital methods, for vaping and nicotine products. Those regulations have not yet been fully set out, but the direction is clear: digital verification is being prepared as a reusable answer to multiple age-restricted activities.
For alcohol, “voluntary” is technically correct. There is no current legal requirement for an adult to use Yoti or EasyID to buy a drink. There is also no current requirement for every venue to accept digital proof of age. The legal compulsion falls on licensed premises to operate an age-verification policy, not on every customer to create a digital identity.
The privacy question that remains
The practical concern is soft compulsion. Businesses may gradually make digital verification the fastest, cheapest or most convenient route. A person who refuses to create a credential may still have a physical-document option today, but the balance can change as the same providers become familiar across cinemas, shops, websites, employment checks and age-restricted goods. No single law needs to declare a universal digital ID mandatory for the credential to become difficult to avoid.
The constitutional criticism should also be stated accurately. The prime minister is not directly elected by the British public. The House of Commons Library explains that political parties identify the person best able to command the confidence of the Commons, after which the monarch appoints that person as prime minister. As of 17 September 2026, the current prime minister, Andy Burnham, is nevertheless an elected Member of Parliament.
The alcohol Order was laid before both Houses and approved on 8 September 2026. It was not imposed without parliamentary involvement. But it was secondary legislation made under powers in an existing Act, rather than a dedicated public vote on whether ordinary transactions should increasingly depend on biometric-backed digital credentials.
The right to privacy is not a promise that the state can never verify anyone’s age. Article 8 of the Human Rights Act protects private life and requires interference with privacy to be lawful, necessary and proportionate. The question is whether collecting biometric and identity information is proportionate to the transaction. Buying a pint requires proof of being over 18; it does not inherently require a person to maintain a reusable identity credential with a private verification provider.
The government’s trust framework includes safeguards for minimisation, security, retention, transparency, biometric processing and user rights. Those rules may reduce what is shown at the till. They do not eliminate the structural concern: a private verification company is positioned between the individual and a growing number of ordinary activities.
The central issue is not whether the barman sees your home address. It is whether a narrow fact — being over 18 — should require the creation of a reusable, biometric-backed credential that can be presented across an expanding network of businesses, platforms and public-service systems. The national digital-ID programme may have been cancelled. The rails underneath it remain. The pints are simply the first place many people will notice them.