The policy states that biometric face recognition data is collected and retained exclusively by third-party verification providers during onboarding, that Fenix does not access this data, and that users may withdraw consent to its retention for authentication by contacting privacy@onlyfans.com.
This analysis describes what OnlyFans's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision structures biometric processing as occurring entirely within third-party data processors, with Fenix asserting no direct access, while simultaneously identifying consent as the lawful basis and establishing a consent withdrawal mechanism. Under GDPR Article 28 and state biometric privacy statutes including Illinois BIPA, the practical enforceability of this structural framing as a full insulation from controller-level accountability may require jurisdiction-specific legal evaluation.
Interpretive note: The practical scope of Fenix's controller-level accountability for biometric processing conducted by third-party processors varies by jurisdiction and depends on regulatory interpretation of the controller/processor boundary under GDPR Article 28 and state biometric privacy statutes.
Under this clause, users undergoing age and identity verification provide biometric selfie data to a third-party provider, not directly to OnlyFans, and the agreement states Fenix does not retain or access the resulting face recognition data. Users may request deletion of biometric authentication records by emailing privacy@onlyfans.com, though the policy notes this may require resubmission of government identity documents in future authentication events.
Cross-platform context
See how other platforms handle Biometric Face Recognition Processing by Third Parties and similar clauses.
Compare across platforms →"Face Recognition Data is collected by and remains with our third-party provider. We do not ourselves collect, receive, possess, or have access to Face Recognition Data at any time. [...] The third-party provider then uses Face Recognition Data to match the two images so they can digitally verify your age and identity. [...] You may request the withdrawal of your consent to the retention of your Face Recognition Data for the purposes of subsequent authentication (and delete this) by contacting privacy@onlyfans.com.Excerpt from OnlyFans's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 9 (processing of special category biometric data) and Article 7 (conditions for consent), UK GDPR equivalents, Illinois BIPA (which imposes obligations on entities that collect or contract …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision structures biometric processing as occurring entirely within third-party data processors, with Fenix asserting no direct access, while simultaneously identifying consent as the lawful basis and establishing a consent withdrawal mechanism. Under GDPR Article 28 and state biometric privacy statutes including Illinois BIPA, the practical enforceability of this structural framing as a full insulation from controller-level accountability may require …
Under this clause, users undergoing age and identity verification provide biometric selfie data to a third-party provider, not directly to OnlyFans, and the agreement states Fenix does not retain or access the resulting face recognition data. Users may request deletion of biometric authentication records by emailing privacy@onlyfans.com, though the policy notes this may require resubmission of government identity documents in …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OnlyFans.