Biometric Data Collection

What it is

PayPal may collect your face scan, voice, or photo to verify your identity for a range of account actions, including logging in, changing your profile, managing payments, and initiating cryptocurrency transfers, when you consent within the app.

Why it matters (compliance & governance perspective)

This provision establishes the operational framework for biometric authentication within PayPal's service delivery. The authorization permits PayPal to deploy biometric verification mechanisms as an alternative or supplementary authentication method for specific account management and transaction functions.

Consumer impact (what this means for users)

Under this provision, PayPal may collect biometric identifiers including face scans and voice identification with consent, and use them across at least seven distinct account actions; users in Illinois, Texas, and Washington should be aware that state biometric privacy laws may provide additional rights regarding collection, retention, and deletion of this data.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and the Washington My Health MY Data Act, as well as GDPR Article 9 (special category data) for EU and UK users. The relevant enforcement authorities include the Illinois courts (private right of action under BIPA), the Texas Attorney General, the Washington Attorney General, and EU/UK national supervisory authorities. The document asserts consent as the lawful basis for biometric collection; GDPR Article 9(2)(a) and BIPA Section 15(b) require informed, written consent prior to collection, and compliance teams should verify that in-app consent flows satisfy these requirements in each applicable jurisdiction. GOVERNANCE EXPOSURE: High. The breadth of use cases for biometric data collection disclosed in this provision, spanning seven distinct account actions, increases the surface area of consent obligations and retention schedule requirements. BIPA provides a private right of action with statutory damages of $1,000 to $5,000 per violation, and Illinois courts have addressed class certification in biometric data cases. The risk is heightened because biometric data is collected not only for authentication but also for cryptocurrency transfers and account limitation removal. JURISDICTION FLAGS: Illinois (BIPA), Texas (CUBI), Washington (My Health MY Data Act), and the EU/EEA and UK (GDPR special category data) create heightened exposure. In Illinois, failure to maintain a publicly available retention and destruction schedule or obtain written consent prior to collection constitutes a per-violation statutory claim. In the EU/EEA and UK, biometric data processing requires an explicit derogation under GDPR Article 9(2) in addition to a standard lawful basis. CONTRACT AND VENDOR IMPLICATIONS: If PayPal uses third-party AI or identity verification vendors to process biometric data, data processing agreements must address the specific use cases disclosed in this provision and include provisions for deletion, retention limits, and prohibition on secondary use, consistent with BIPA and GDPR Article 28 requirements. Procurement teams should audit vendor contracts to confirm these restrictions are present and enforceable. COMPLIANCE CONSIDERATIONS: Compliance teams should (1) confirm that in-app consent flows are specific to each disclosed use case rather than a single blanket consent; (2) verify that biometric data retention and destruction schedules are publicly posted as required by BIPA; (3) map all vendors processing biometric data and confirm data processing agreements are in place; and (4) assess whether users in Illinois, Texas, and Washington are provided jurisdiction-specific disclosures and consent mechanisms.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• AI Model Training Using Personal Information high
• Inferred Data Collection high
• Data Sharing with Data Brokers and Third Parties high
• Precise Geolocation Collection medium
• Cross-Service Data Association (Venmo, Honey, Fastlane) medium
• Privacy Statement Update Notice low

Related Analysis

• Netflix Updated Terms Authorize Voice Data Collection: April 2026

  Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.

• What Google Actually Knows About You

  Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.