Luma collects detailed technical information about your device, including advertising identifiers, installed applications, CPU usage, and network type, every time you use its services.
This analysis describes what Luma AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The collection of advertising identifiers and application installation data alongside usage behavior enables detailed user profiling that goes beyond basic service delivery.
Luma automatically collects a detailed set of device signals, including identifiers used for advertising, your installed applications, and network details. This data, combined with usage and location information, could support detailed user profiling for advertising or analytics purposes, though the policy does not specify all downstream uses.
How other platforms handle this
Geolocation data, such as device location. Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer's interaction with an internet website, application, or advertisement. Device identifiers, such as IP address, unique d...
When you visit the Careers portion of our websites, we collect the information that you provide to us in connection with your job application. This includes but is not limited to business and personal contact information, professional credentials and skills, educational and work history and other in...
American does not knowingly collect personal information directly from children – persons under the age of 13, or another age if required by applicable law – other than when required to comply with the law or for safety and security reasons. Due to the nature of our Services, we may collect travel i...
Monitoring
Luma AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"Device data. We receive information about the device and software you use to access our Services, such as your computer's or mobile device's operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier and manufacturer, radio/network information (e.g., WiFi, LTE, 4G), application installations, and push notification tokens.— Excerpt from Luma AI's Luma AI Privacy Policy
REGULATORY LANDSCAPE: The collection of advertising identifiers engages GDPR Article 6 and the ePrivacy Directive for EEA users, particularly regarding consent for device-based tracking. CCPA's definition of personal information encompasses unique identifiers and device data. The FTC Act is relevant to representations about how advertising identifiers are used. The EU AI Act may require evaluation if device data contributes to automated profiling that has significant effects on users. GOVERNANCE EXPOSURE: Medium. The breadth of device data collected, particularly advertising identifiers and application installation lists, is on the more expansive end of common industry practice for a creative AI platform. The policy references a Cookie Policy for further detail on tracking technologies but does not fully specify the purposes for which advertising identifiers are used. JURISDICTION FLAGS: EEA and UK users have the strongest rights regarding consent for advertising identifier use under the ePrivacy Directive and GDPR. California users may exercise CCPA rights to opt out of sharing unique identifiers with third parties for advertising purposes. Illinois and other states with biometric or device privacy laws may also engage depending on the nature of identifiers collected. CONTRACT AND VENDOR IMPLICATIONS: Enterprises should assess whether employee device data collected through Luma apps is disclosed appropriately in internal privacy notices and whether acceptable use policies address Luma's device data collection practices. COMPLIANCE CONSIDERATIONS: Legal teams should review whether the Cookie Policy referenced in this document provides adequate supplemental disclosure for tracking and advertising identifier use. Consent mechanism audits should verify that device-based tracking consent flows comply with applicable law in key jurisdictions.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The collection of advertising identifiers and application installation data alongside usage behavior enables detailed user profiling that goes beyond basic service delivery.
Luma automatically collects a detailed set of device signals, including identifiers used for advertising, your installed applications, and network details. This data, combined with usage and location information, could support detailed user profiling for advertising or analytics purposes, though the policy does not specify all downstream uses.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Luma AI.