The policy states that PayPal collects biometric data including voice identification, photo identification, and face scans, with user consent in the user experience, for account authentication, identity verification, password recovery, payment management, and cryptocurrency transfers. Biometric data is retained for up to 3 years after account closure.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that PayPal may collect and retain biometric identifiers and biometric information, and that the retention period extends up to 3 years after account closure. State biometric privacy laws including Illinois BIPA impose specific written consent, retention schedule, and destruction requirements that may not be fully addressed by a general policy-level consent disclosure.
Interpretive note: The adequacy of the consent mechanism described and the compatibility of the 3-year post-closure retention period with Illinois BIPA and equivalent state statutes depends on the specific implementation details of the in-experience consent flow, which are not fully described in this policy.
Added retention language specifying biometric data is retained "for as long as needed" with details about storage duration now included.
View full change record →Under this clause, PayPal may collect facial scans, voice recordings, and photo identification data when users consent during account authentication or cryptocurrency transfer workflows. This data is retained for up to 3 years after account closure unless applicable law requires longer retention.
Cross-platform context
See how other platforms handle Biometric Data Collection and Retention and similar clauses.
Compare across platforms →"Biometric data : Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience to authenticate you for certain actions related to your account, including, for example, to verify your identity before you access accounts and Services, recover passwords, update profile information, manage payments and payment methods, lift account limitations, and initiate cryptocurrency transfers. We retain biometric data for as long as needed or permitted given the purpose for which it was collected and no more than 3 years after your account closes, unless otherwise required by applicable law.Excerpt from PayPal's Privacy Statement
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that PayPal may collect and retain biometric identifiers and biometric information, and that the retention period extends up to 3 years after account closure. State biometric privacy laws including Illinois BIPA impose specific written consent, retention schedule, and destruction requirements that may not be fully addressed by a general policy-level consent disclosure.
Under this clause, PayPal may collect facial scans, voice recordings, and photo identification data when users consent during account authentication or cryptocurrency transfer workflows. This data is retained for up to 3 years after account closure unless applicable law requires longer retention.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.