The policy explicitly carves out 'Face Recognition Data' as a distinct data category separate from the selfie-based age estimation and identity verification data described in the onboarding sections.
This analysis describes what OnlyFans's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The explicit separation of Face Recognition Data as a distinct category suggests the platform may process facial recognition data in some contexts, which carries the most stringent biometric data obligations under laws like Illinois BIPA.
Interpretive note: The document is truncated and the full Face Recognition Data section was not available for review, making it impossible to assess the full scope, legal basis, or consent mechanisms for this data category.
By acknowledging Face Recognition Data as a separate category, the policy implies this data type exists but the truncated document does not fully describe when or how it is collected, creating transparency gaps about a highly sensitive data type.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Third-Party Onboarding Data and Technical Data does not include Face Recognition Data, as set out below.Excerpt from OnlyFans's Privacy Policy
REGULATORY LANDSCAPE: Face Recognition Data is the most heavily regulated biometric data category in the US under Illinois BIPA, Texas CUBI, and Washington state law, all of which provide strong protections and in the case …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The explicit separation of Face Recognition Data as a distinct category suggests the platform may process facial recognition data in some contexts, which carries the most stringent biometric data obligations under laws like Illinois BIPA.
By acknowledging Face Recognition Data as a separate category, the policy implies this data type exists but the truncated document does not fully describe when or how it is collected, creating transparency gaps about a highly sensitive data type.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OnlyFans.