Luma collects detailed technical information about your device, including advertising identifiers, installed applications, CPU usage, and network type, every time you use its services.
This analysis describes what Luma AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The collection of advertising identifiers and application installation data alongside usage behavior enables detailed user profiling that goes beyond basic service delivery.
Provision name slightly revised from 'Broad Data Collection — Device, Location, and Usage Tracking' to 'Broad Device and Usage Data Collection' but excerpt text appears identical.
View full change record →Luma automatically collects a detailed set of device signals, including identifiers used for advertising, your installed applications, and network details. This data, combined with usage and location information, could support detailed user profiling for advertising or analytics purposes, though the policy does not specify all downstream uses.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.
We collect your personal data when you use our Services, create a new eBay account, provide us with information via a web form, add or update information in your eBay account, participate in online community discussions or otherwise interact with us.
Monitoring
Luma AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Device data. We receive information about the device and software you use to access our Services, such as your computer's or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier and manufacturer, radio/network information (e.g., WiFi, LTE, 4G), application installations, and push notification tokens.— Excerpt from Luma AI's Luma AI Privacy Policy
REGULATORY LANDSCAPE: The collection of advertising identifiers engages GDPR Article 6 and the ePrivacy Directive for EEA users, particularly regarding consent for device-based tracking. CCPA's definition of personal information encompasses unique identifiers and device data. The FTC Act is relevant to representations about how advertising identifiers are used. The EU AI Act may require evaluation if device data contributes to automated profiling that has significant effects on users. GOVERNANCE EXPOSURE: Medium. The breadth of device data collected, particularly advertising identifiers and application installation lists, is on the more expansive end of common industry practice for a creative AI platform. The policy references a Cookie Policy for further detail on tracking technologies but does not fully specify the purposes for which advertising identifiers are used. JURISDICTION FLAGS: EEA and UK users have the strongest rights regarding consent for advertising identifier use under the ePrivacy Directive and GDPR. California users may exercise CCPA rights to opt out of sharing unique identifiers with third parties for advertising purposes. Illinois and other states with biometric or device privacy laws may also engage depending on the nature of identifiers collected. CONTRACT AND VENDOR IMPLICATIONS: Enterprises should assess whether employee device data collected through Luma apps is disclosed appropriately in internal privacy notices and whether acceptable use policies address Luma's device data collection practices. COMPLIANCE CONSIDERATIONS: Legal teams should review whether the Cookie Policy referenced in this document provides adequate supplemental disclosure for tracking and advertising identifier use. Consent mechanism audits should verify that device-based tracking consent flows comply with applicable law in key jurisdictions.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The collection of advertising identifiers and application installation data alongside usage behavior enables detailed user profiling that goes beyond basic service delivery.
Luma automatically collects a detailed set of device signals, including identifiers used for advertising, your installed applications, and network details. This data, combined with usage and location information, could support detailed user profiling for advertising or analytics purposes, though the policy does not specify all downstream uses.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Luma AI.