The notice authorizes collection of facial images and voice recordings from which biometric identifiers (faceprints, voiceprints, minutiae templates) are extracted for identity verification, with that biometric data shared with Snowflake Computing and Amazon Web Services and retained for up to 365 days before deletion.
This analysis describes what Checkout.com's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision names the specific biometric data categories collected, the two third-party cloud processors receiving that data, and establishes a 365-day outer retention limit, each of which are operationally significant parameters for compliance with GDPR, UK GDPR, and US state-level biometric privacy statutes that impose consent, disclosure, and retention requirements.
Interpretive note: The phrase 'or if our collection of biometric information is otherwise permitted by law' reserves a non-consent legal basis that is not further specified, and the adequacy of the stated consent mechanism under US state biometric laws (BIPA, Texas CUBI) requires jurisdiction-specific legal evaluation.
The updated policy explicitly states that Checkout.com uses recordings of calls with merchants for training, product development, and marketing purposes. The policy also clarifies that merchant customer contact, cardholder, transaction, and technical information is processed to deliver payment services, detect fraud, and comply with legal obligations. Merchants and their customers should review the updated disclosure to understand how their communications and transaction data are used.
View change record →This provision establishes that Merchant Customers who use Checkout's identity verification services may have facial images, voiceprints, and derived biometric templates collected, shared with Snowflake Computing and Amazon Web Services, and retained for up to 365 days, with processing stated to require explicit consent. The agreement also states that biometric collection may proceed where otherwise permitted by law, independent of consent.
Cross-platform context
See how other platforms handle Biometric Data Collection and Retention and similar clauses.
Compare across platforms →"If you consent to our collection of biometric information or if our collection of biometric information is otherwise permitted by law, you agree that we may collect your imagery of the face, and voice recordings, from which an identifier template such as a faceprint, a minutiae template, or a voiceprint, can be extracted in order to verify your identity using Checkout's verification services. Your biometric information may be shared with our third-party cloud providers Snowflake Computing and Amazon Web Services. We will delete your biometric information no later than 365 days after the date you provide it.Excerpt from Checkout.com's Privacy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision names the specific biometric data categories collected, the two third-party cloud processors receiving that data, and establishes a 365-day outer retention limit, each of which are operationally significant parameters for compliance with GDPR, UK GDPR, and US state-level biometric privacy statutes that impose consent, disclosure, and retention requirements.
This provision establishes that Merchant Customers who use Checkout's identity verification services may have facial images, voiceprints, and derived biometric templates collected, shared with Snowflake Computing and Amazon Web Services, and retained for up to 365 days, with processing stated to require explicit consent. The agreement also states that biometric collection may proceed where otherwise permitted by law, independent of …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Checkout.com.