Coinbase collects copies of your government-issued ID (passport, driver's license) and may use facial recognition technology through third-party vendors to confirm who you are.
Expanded from brief statement about facial geometry to comprehensive list including specific document types and explicit mention of third-party identity verification services using facial recognition.
View full change record →Your facial biometric data and government ID scans are collected and processed by Coinbase and its third-party identity verification vendors, creating exposure to biometric privacy laws and data breach risks that cannot be remedied by simply changing account credentials.
How other platforms handle this
You also consent to PayPal obtaining your personal and/or business credit report from a credit reporting agency at account opening and whenever we reasonably believe there may be an increased level of risk associated with your business account.
We, and some of our service providers and third-party partners, also use technologies, including cookies and web beacons and software development kits ("SDKs"), to automatically collect certain types of usage and device information when you use our Services or interact with our emails. For example, ...
Geolocation Information. The location of your device, including your IP address and location of your network provider. This may include precise geolocation information. For more information and to learn how to disable collection of precise geolocation information from your mobile device, please see ...
Biometric and government ID data is among the most sensitive personal information — if breached or misused, it cannot be changed like a password and can enable identity fraud.
(1) REGULATORY FRAMEWORK: This provision implicates Illinois BIPA (740 ILCS 14/1 et seq.), which requires written consent, retention schedules, and destruction policies for biometric identifiers; Texas CUBI (Tex. Bus. & Com. Code §503.001); Washington My Health MY Data Act; GDPR Art. 9 (special category biometric data requiring explicit consent or necessity for a legal obligation); CCPA/CPRA definition of 'sensitive personal information' (Cal. Civ. Code §1798.140(ae)); and FinCEN KYC/CIP requirements (31 CFR §1020.220) mandating identity verification. Enforcement authorities include the Illinois AG, FTC, and EU national supervisory authorities. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.