The policy discloses that PayPal may collect biometric data including voice identification, photo identification, and face scans for authentication purposes, with collection stated to occur upon consent in the user experience. The policy establishes a 3-year maximum retention period for biometric data after account closure.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses collection of biometric data, which is classified as Sensitive Personal Information under the policy and is subject to heightened statutory protections in multiple jurisdictions including Illinois under BIPA and Texas and Washington under their respective biometric privacy statutes. The consent mechanism, retention period, and disclosure practices for biometric data carry distinct compliance obligations that differ from general personal data requirements.
⚠ Biometric data collected with user consent will be retained and used for authentication and related purposes as described, for up to 3 years after account closure unless applicable law requires otherwise
Cross-platform context
See how other platforms handle Biometric Data Collection and Use and similar clauses.
Compare across platforms →"Biometric data : Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience to authenticate you for certain actions related to your account, including, for example, to verify your identity before you access accounts and Services, recover passwords, update profile information, manage payments and payment methods, lift account limitations, and initiate cryptocurrency transfers.Excerpt from PayPal's Privacy Statement
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision discloses collection of biometric data, which is classified as Sensitive Personal Information under the policy and is subject to heightened statutory protections in multiple jurisdictions including Illinois under BIPA and Texas and Washington under their respective biometric privacy statutes. The consent mechanism, retention period, and disclosure practices for biometric data carry distinct compliance obligations that differ from general …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.