Coinbase collects your name, address, date of birth, government-issued ID, and biometric data such as facial recognition information when you sign up and verify your identity.
This analysis describes what Coinbase's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The collection of biometric data for identity verification is subject to specific state laws including Illinois BIPA, which imposes strict notice, consent, and deletion requirements, and the policy's retention of this data may interact with those obligations.
Interpretive note: The exact scope of biometric data collected and the specific retention periods are not fully detailed in the truncated document, creating some uncertainty about precise compliance obligations.
Current version consolidates biometric and KYC data collection into a single provision and changes language from 'may collect' to 'collect,' emphasizing active collection of government-issued ID alongside biometric data.
View full change record →Users who complete identity verification on Coinbase provide biometric data, which the policy states Coinbase collects and retains; the handling of this biometric data is subject to varying legal protections depending on the user's state of residence.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
"We collect personal information you provide to us such as your name, address, phone number, email address, date of birth, and government-issued identification. We may also collect biometric information from you, such as facial recognition data, to verify your identity.Excerpt from Coinbase's Privacy Policy
REGULATORY LANDSCAPE: Biometric data collection engages the Illinois Biometric Information Privacy Act, Texas CUBI Act, and Washington My Health MY Data Act, each of which imposes distinct notice, written consent, and retention schedule requirements.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The collection of biometric data for identity verification is subject to specific state laws including Illinois BIPA, which imposes strict notice, consent, and deletion requirements, and the policy's retention of this data may interact with those obligations.
Users who complete identity verification on Coinbase provide biometric data, which the policy states Coinbase collects and retains; the handling of this biometric data is subject to varying legal protections depending on the user's state of residence.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Coinbase.