Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
DraftKings authorizes vendors Onfido and Socure to collect and process facial scan data from users' government ID photos and selfie photos or videos for identity verification, with retention scheduled for up to three years following a user's last interaction with the verification provider. Users may revoke consent by emailing privacy@draftkings.com, though doing so may limit their ability to complete verification required to access services.
This analysis describes what DraftKings's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes collection and retention of biometric identifiers by named third-party processors under a consent framework, with a stated retention period of up to three years post-last interaction. This schedule and the consent mechanism require evaluation under state biometric privacy statutes including Illinois BIPA, Texas CUBI, and Washington MHMDA, which impose specific written consent, publicly available retention schedule, and destruction obligation requirements that may differ from the terms stated in this notice.
Interpretive note: Compliance with applicable state biometric statutes depends on whether the consent mechanism and retention schedule stated in the notice satisfy jurisdiction-specific written consent and destruction requirements, which vary by state and are not fully resolved by the document language alone.
This provision establishes that facial scan data extracted from government-issued ID documents and user-submitted selfies is collected and stored by Onfido or Socure for up to three years following the user's last interaction with the provider. Under this clause, users who decline or revoke consent may find their ability to complete account verification and access certain services limited.
Cross-platform context
See how other platforms handle Biometric Facial Scan Collection and Retention and similar clauses.
Compare across platforms →Monitoring
DraftKings has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"With your consent, we may use facial image scan services provided by our vendors (including, for example, Onfido and Socure) to help verify your identity. These biometric identity verification providers and their contractors compare facial scan data extracted from your photo in your ID (e.g., driver's license) to the facial scan data extracted from the selfie photo or video you upload, and then report back to us whether or not there is a match. These scans and associated results may constitute biometric information or biometric identifiers under certain laws. Any biometric identifier/information or representation of it will be processed based on your consent and collected, stored, and managed by Onfido, Socure, or the applicable biometric identity verification provider. Biometric data collected and processed for our verification purposes is scheduled to be retained until the earlier of when verification is complete or for up to three (3) years following your last interaction with the biometric identity verification provider, unless otherwise set forth at the time you provide consent or unless otherwise required by law or legal process.Excerpt from DraftKings's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates Illinois BIPA (740 ILCS 14), Texas Capture or Use of Biometric Identifier Act (CUBI), Washington My Health MY Data Act, and potentially New York and other state biometric statutes. Enforcement authorities include State Attorneys General and, under BIPA, private plaintiffs with a statutory damages right. The notice's consent framework and three-year retention schedule require evaluation against BIPA's requirements for written consent prior to collection, a publicly available written retention and destruction policy, and destruction within three years of the last interaction or when the purpose is fulfilled, whichever is first. 2) GOVERNANCE EXPOSURE: High. The notice states biometric data is retained for up to three years following the user's last interaction with the biometric identity verification provider, which may or may not align with applicable state-mandated destruction schedules. Processing is delegated to Onfido and Socure as data controllers or processors, and the notice directs users to review vendor-specific privacy notices, which creates a layered data governance structure that compliance teams should map against applicable state requirements. 3) JURISDICTION FLAGS: Illinois, Texas, and Washington create heightened exposure due to biometric-specific statutes with private rights of action or civil enforcement. California's CPRA treats biometric information as sensitive personal information subject to opt-in consent requirements. The notice acknowledges that biometric verification may not be available in certain states, countries, and jurisdictions, suggesting DraftKings has made some geographic carve-outs, though the specific excluded jurisdictions are not enumerated in the notice. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should review data processing agreements with Onfido and Socure to confirm alignment with applicable state biometric statutes, including whether those agreements contain compliant retention, destruction, and prohibition-on-sale provisions. The notice states data is collected, stored, and managed by Onfido, Socure, or the applicable provider, which means DraftKings' compliance exposure is partly dependent on vendor contractual obligations. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that the consent mechanism presented to users at the point of biometric data collection constitutes written consent meeting applicable statutory requirements. A publicly available retention and destruction schedule should be verified as existing and consistent with the three-year timeline stated in the notice. Data mapping should confirm that biometric data flows are documented for CCPA sensitive data and BIPA-jurisdiction users. Any sale or sharing of biometric data with advertising or analytics vendors would create material additional exposure under BIPA and CCPA.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision authorizes collection and retention of biometric identifiers by named third-party processors under a consent framework, with a stated retention period of up to three years post-last interaction. This schedule and the consent mechanism require evaluation under state biometric privacy statutes including Illinois BIPA, Texas CUBI, and Washington MHMDA, which impose specific written consent, publicly available retention schedule, and …
This provision establishes that facial scan data extracted from government-issued ID documents and user-submitted selfies is collected and stored by Onfido or Socure for up to three years following the user's last interaction with the provider. Under this clause, users who decline or revoke consent may find their ability to complete account verification and access certain services limited.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by DraftKings.