OnlyFans Privacy Policy

This privacy policy, published by Fenix International Limited (operator of OnlyFans), governs the processing of personal data for Creators, Fans, and Content Collaborators under a data controller framework, citing contract performance, legal obligation, legitimate interests, and consent as lawful bases under GDPR. The policy states that OnlyFans collects an extensive range of data categories including government identity documents, selfie-based age verification (including biometric-adjacent face estimation data for some users), financial data (bank account details, tax forms including W-9 and 1099 forms), technical and usage data, and communications content such as chat messages; the terms also authorize sharing this data with third-party service providers, payment processors, identity verification vendors, advertising partners, and law enforcement. Notably, the policy explicitly carves out 'Face Recognition Data' as a distinct category separate from general onboarding data, suggesting awareness of biometric data regulation, and it discloses age estimation processing for Fans via third-party providers, a practice that may engage biometric or sensitive data obligations depending on jurisdiction; the policy asserts that aggregated or de-identified data falls outside its scope, which is an assertion that may require evaluation under regulations such as CCPA where re-identification risk standards apply. The policy engages GDPR (as Fenix International Limited is a UK-registered entity), UK GDPR post-Brexit, CCPA and other U.S. state privacy laws (addressed in a dedicated Section 18), and potentially Illinois BIPA and similar state biometric laws given the face estimation and identity verification processes described; compliance considerations include the adequacy of consent mechanisms for biometric-adjacent data, the lawfulness of international data transfers, and the sufficiency of data subject rights mechanisms for users across multiple jurisdictions.