Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Chase may require customers to enroll a trusted mobile device to access certain account services, payment functions, and wire transfers; enrollment may require submitting a photo of a government-issued ID and biometric data such as a selfie. Chase retains identity document images and biometric data to the extent permitted by applicable law.
This analysis describes what Chase's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The collection and retention of biometric data (selfie) and government-issued identity document images during trusted device enrollment implicates state biometric privacy statutes including the Illinois Biometric Information Privacy Act (BIPA) and similar laws in Texas and Washington. The agreement's retention limitation to 'the extent permitted by applicable law' does not specify retention periods or destruction timelines, which are required disclosures under BIPA and comparable statutes.
Interpretive note: The specific retention period and destruction schedule for biometric data and identity document images are not stated in the agreement text and are deferred to applicable law and the privacy policy, creating interpretive uncertainty about whether specific statutory requirements such as BIPA are fully addressed.
This provision authorizes Chase to collect biometric data and identity document images as part of trusted device enrollment, which may be required to access wire transfers, payments, and certain account services. The agreement states that identity document images will be stored only to the extent permitted by applicable law, but does not specify retention periods or destruction schedules in the agreement text.
Cross-platform context
See how other platforms handle Trusted Device Enrollment and Biometric Data Collection and similar clauses.
Compare across platforms →Monitoring
Chase has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"To help protect your account, we may require that you use a trusted device to: Manage your account and/or digital profile, Access certain account services, Make certain payments and transfers, or Authorize or approve payments and transfers. A trusted device is an eligible device that has been successfully enrolled with us based on specific criteria we set and may modify from time to time in our sole discretion... During the process of making your eligible device a trusted device, we may require you to verify your identity and authenticate by taking certain actions, which may include, but are not limited to, one or more of the following: Taking a photo with your mobile phone camera of your acceptable form of identification; Entering information from your debit card (e.g., CVV), or Providing biometrics (e.g., selfie), or Using a token where available. Valid driver's licenses and state identifications qualify as acceptable forms of identification; additional qualifying forms of identification may be added by us periodically. The image of your identification will be stored or retained only to the extent permitted by applicable law and will be used as permitted under our privacy policy.Excerpt from Chase's Deposit Account Agreement
1. REGULATORY LANDSCAPE: Biometric data collection implicates the Illinois Biometric Information Privacy Act (BIPA), which requires written informed consent, a publicly available retention and destruction policy, and prohibits sale or profit from biometric data. Texas and Washington have similar statutes. The agreement's reference to retaining data 'to the extent permitted by applicable law' and 'as permitted under our privacy policy' may satisfy disclosure requirements in some jurisdictions but the agreement text alone does not reproduce the specific retention and destruction schedule required by BIPA. State AGs in Illinois, Texas, and Washington have enforcement authority. 2. GOVERNANCE EXPOSURE: High for customers in Illinois, Texas, and Washington. The collection of selfie biometric data during account enrollment creates direct BIPA exposure if the written consent and retention policy requirements are not separately satisfied outside of this agreement text. BIPA provides a private right of action with statutory damages of $1,000 to $5,000 per violation. 3. JURISDICTION FLAGS: Illinois (BIPA), Texas (Capture or Use of Biometric Identifier Act), and Washington (My Health MY Data Act and biometric privacy provisions) create heightened exposure. California's CCPA and CPRA include biometric information as sensitive personal information subject to additional disclosure and opt-out rights. The agreement notes that tablets, laptops, and desktop computers are not eligible trusted devices, limiting enrollment to mobile smartphones. 4. CONTRACT AND VENDOR IMPLICATIONS: Third-party identity verification vendors involved in the trusted device enrollment process should be assessed for compliance with applicable biometric privacy statutes as data processors. Vendor contracts should include appropriate data processing agreements and deletion obligations. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that a standalone biometric data retention and destruction policy satisfying BIPA requirements is publicly available and linked from the digital enrollment flow. Consent mechanisms during trusted device enrollment should be audited to confirm they satisfy written consent requirements under applicable state law. The retention limitation language should be mapped against specific state law timelines.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The collection and retention of biometric data (selfie) and government-issued identity document images during trusted device enrollment implicates state biometric privacy statutes including the Illinois Biometric Information Privacy Act (BIPA) and similar laws in Texas and Washington. The agreement's retention limitation to 'the extent permitted by applicable law' does not specify retention periods or destruction timelines, which are required disclosures …
This provision authorizes Chase to collect biometric data and identity document images as part of trusted device enrollment, which may be required to access wire transfers, payments, and certain account services. The agreement states that identity document images will be stored only to the extent permitted by applicable law, but does not specify retention periods or destruction schedules in the …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Chase.