Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that biometric face recognition data is collected and retained exclusively by third-party verification providers during onboarding, that Fenix does not access this data, and that users may withdraw consent to its retention for authentication by contacting privacy@onlyfans.com.
This analysis describes what OnlyFans's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision structures biometric processing as occurring entirely within third-party data processors, with Fenix asserting no direct access, while simultaneously identifying consent as the lawful basis and establishing a consent withdrawal mechanism. Under GDPR Article 28 and state biometric privacy statutes including Illinois BIPA, the practical enforceability of this structural framing as a full insulation from controller-level accountability may require jurisdiction-specific legal evaluation.
Interpretive note: The practical scope of Fenix's controller-level accountability for biometric processing conducted by third-party processors varies by jurisdiction and depends on regulatory interpretation of the controller/processor boundary under GDPR Article 28 and state biometric privacy statutes.
Under this clause, users undergoing age and identity verification provide biometric selfie data to a third-party provider, not directly to OnlyFans, and the agreement states Fenix does not retain or access the resulting face recognition data. Users may request deletion of biometric authentication records by emailing privacy@onlyfans.com, though the policy notes this may require resubmission of government identity documents in future authentication events.
Cross-platform context
See how other platforms handle Biometric Face Recognition Processing by Third Parties and similar clauses.
Compare across platforms →Monitoring
OnlyFans has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Face Recognition Data is collected by and remains with our third-party provider. We do not ourselves collect, receive, possess, or have access to Face Recognition Data at any time. [...] The third-party provider then uses Face Recognition Data to match the two images so they can digitally verify your age and identity. [...] You may request the withdrawal of your consent to the retention of your Face Recognition Data for the purposes of subsequent authentication (and delete this) by contacting privacy@onlyfans.com.Excerpt from OnlyFans's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 9 (processing of special category biometric data) and Article 7 (conditions for consent), UK GDPR equivalents, Illinois BIPA (which imposes obligations on entities that collect or contract for biometric data collection regardless of direct access), Texas CUBI, Washington My Health MY Data Act, and CCPA/CPRA biometric information provisions. The ICO and relevant EU supervisory authorities maintain enforcement jurisdiction over the GDPR aspects. Illinois BIPA enforcement is primarily through private right of action. 2) GOVERNANCE EXPOSURE: High. The policy's assertion that Fenix does not collect, receive, possess, or have access to Face Recognition Data may be legally significant but does not necessarily resolve GDPR controller accountability obligations where Fenix determines the purpose and means of the verification process and selects the processor. Under Illinois BIPA, courts have considered whether contracting entities bear liability even absent direct data possession. The biometric consent withdrawal mechanism (email to privacy@onlyfans.com) must satisfy GDPR Article 7(3) requirements for withdrawal to be as easy as giving consent. 3) JURISDICTION FLAGS: Illinois BIPA creates the highest private litigation exposure for biometric data provisions, as it does not require actual harm for statutory damages claims. Texas CUBI and Washington state law create additional compliance obligations. EU and UK supervisory authorities may evaluate whether the controller/processor relationship is structured in compliance with Article 28 DPA requirements. California CPRA treats biometric information as sensitive personal information requiring opt-in consent for sale or sharing. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should verify that Article 28 Data Processing Agreements are in place with all biometric verification vendors, that those agreements address the specific retention and deletion obligations disclosed in this policy, and that vendor security certifications and breach notification obligations are contractually established. The policy's statement that third-party providers may retain Face Recognition Data for fraud prevention purposes independently of user consent withdrawal warrants specific contractual scope review. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate: whether consent collection mechanisms for biometric processing satisfy GDPR Article 7 and state biometric law requirements in each operational jurisdiction; whether the consent withdrawal process at privacy@onlyfans.com is operationally equivalent in ease to the original consent grant; whether BIPA-required written policies and retention schedules have been published by the third-party providers; and whether data mapping documentation reflects the processor relationship accurately for audit purposes.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision structures biometric processing as occurring entirely within third-party data processors, with Fenix asserting no direct access, while simultaneously identifying consent as the lawful basis and establishing a consent withdrawal mechanism. Under GDPR Article 28 and state biometric privacy statutes including Illinois BIPA, the practical enforceability of this structural framing as a full insulation from controller-level accountability may require …
Under this clause, users undergoing age and identity verification provide biometric selfie data to a third-party provider, not directly to OnlyFans, and the agreement states Fenix does not retain or access the resulting face recognition data. Users may request deletion of biometric authentication records by emailing privacy@onlyfans.com, though the policy notes this may require resubmission of government identity documents in …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OnlyFans.