Every time you post a BeReal, the app takes a photo from both your front camera (your face) and your rear camera (your surroundings) at the same moment, and both images along with time and location data are saved by the company.
This analysis describes what BeReal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision is structurally unique: unlike most apps that collect photos you choose to share, BeReal's mechanism captures facial imagery and environmental context simultaneously on a randomised timer, meaning users may not always have full control over what is captured.
Interpretive note: Whether BeReal's facial imagery collection constitutes a 'biometric identifier' under BIPA or GDPR Article 9 depends on the specific downstream processing applied, which is not fully specified in the policy text available.
This clause means your facial image and a photo of your environment are captured together at unpredictable moments, and this dual-image data along with location and timestamp metadata is held by BeReal and may be shared with service providers.
Cross-platform context
See how other platforms handle Dual-Camera Simultaneous Image Capture and similar clauses.
Compare across platforms →Monitoring
BeReal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"When you take a BeReal, we capture photos from both your front and back cameras at the same time. These images, along with associated metadata such as the time and location of capture, are collected and stored by BeReal.— Excerpt from BeReal's BeReal Privacy Policy
(1) REGULATORY LANDSCAPE: The simultaneous front-camera facial capture may implicate the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington's biometric privacy law, each of which imposes written consent, data retention schedule disclosure, and prohibition on sale requirements for biometric identifiers and biometric information. The relevant enforcement authority for BIPA is the Illinois courts (private right of action); for CUBI, the Texas Attorney General. Under GDPR, facial imagery may constitute special category biometric data under Article 9 if processed for the purpose of uniquely identifying a natural person, requiring explicit consent or another Article 9(2) basis. The CNIL is the primary supervisory authority for BeReal's EU processing. (2) GOVERNANCE EXPOSURE: High. The randomised, mandatory dual-camera capture is operationally distinctive: users cannot complete the core product action without submitting facial imagery. If facial imagery is processed in a way that enables identification (e.g., through downstream facial recognition or feature extraction by service providers), this could trigger BIPA's written consent requirements and GDPR Article 9 obligations. Even absent such processing, the collection of facial imagery at scale from a platform with a young user base creates heightened regulatory attention risk. (3) JURISDICTION FLAGS: Illinois, Texas, and Washington create the highest biometric privacy exposure. EU/EEA users are protected by GDPR Article 9 if the imagery is processed for identification purposes. California users may have additional rights under CPRA regarding sensitive personal information. Minors across all jurisdictions create compounded exposure given age-specific consent requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Any third-party service provider receiving dual-camera imagery (e.g., cloud storage, content delivery, or moderation vendors) must be assessed for compliance with BIPA and equivalent statutes. Data processing agreements should explicitly prohibit downstream biometric processing or sale. Standard Contractual Clauses must cover image data transfers to non-EEA vendors. (5) COMPLIANCE CONSIDERATIONS: Legal teams should determine whether BeReal's current consent flow constitutes valid written informed consent under BIPA for Illinois users prior to facial image capture. A data mapping exercise should document all vendors receiving camera imagery and the processing purposes. If any service provider performs facial feature analysis (even for moderation), an Article 9 legal basis assessment under GDPR is required. Retention schedules for dual-camera imagery should be documented and disclosed.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision is structurally unique: unlike most apps that collect photos you choose to share, BeReal's mechanism captures facial imagery and environmental context simultaneously on a randomised timer, meaning users may not always have full control over what is captured.
This clause means your facial image and a photo of your environment are captured together at unpredictable moments, and this dual-image data along with location and timestamp metadata is held by BeReal and may be shared with service providers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by BeReal.