Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses collection of physical movement data for exercise form feedback and voice data for command recognition, acknowledging that physical characteristics may qualify as biometric information under applicable jurisdiction-specific privacy regulations and directing users to a separate Biometric Privacy Policy.
This analysis describes what Peloton's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision acknowledges that physical movement and form analysis data may constitute biometric information under applicable state law, creating compliance exposure under Illinois BIPA and similar statutes that impose specific written consent, retention, and destruction requirements. The policy references a separate Biometric Privacy Policy but does not reproduce its terms, requiring review of that document for complete compliance assessment.
Interpretive note: Whether specific Peloton physical movement and form analysis data constitutes biometric information as legally defined under Illinois BIPA or other statutes requires jurisdiction-specific legal analysis beyond what the policy text alone establishes.
Under this clause, the agreement authorizes collection of physical movement characteristics for form analysis and voice data for command recognition; the policy acknowledges these may qualify as biometric information in some jurisdictions and references a separate Biometric Privacy Policy governing those practices. Voice data collected via opt-in is described as not stored by Peloton after use.
Cross-platform context
See how other platforms handle Physical Characteristics and Biometric-Adjacent Data Collection and similar clauses.
Compare across platforms →Monitoring
Peloton has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Physical Characteristics. Some physical characteristics are collected in connection with our Services; for example, some Services record your physical movement to provide feedback on your exercise form. Physical characteristics are not used to identify you. Depending on the privacy regulations in your jurisdiction, some of these physical characteristics may fall under the definition of biometric information (see Biometric Privacy Policy). [...] Voice. We may use a person's voice to activate the Services and follow workout commands where Voice Control is available. If a person opts in, voice data may be used to improve our abilities to understand voice commands in general when you are using the Peloton Guide and the Cross Training Series. This data is not used for identification purposes nor is it stored by Peloton.Excerpt from Peloton's Privacy Policy
REGULATORY LANDSCAPE: Illinois BIPA requires written informed consent, a publicly available retention schedule, and destruction policies before collecting biometric identifiers or biometric information, including data derived from physical measurements. Texas and Washington have enacted biometric privacy statutes with similar requirements. The policy's acknowledgment that physical characteristics may fall under biometric definitions in some jurisdictions is a direct engagement with these frameworks. The FTC and State Attorneys General have enforcement authority over unfair biometric data practices. GOVERNANCE EXPOSURE: High. The collection of physical movement data through Peloton Guide and Cross-Training Series features, combined with the policy's acknowledgment of potential biometric classification, creates significant exposure under Illinois BIPA where statutory damages of $1,000 to $5,000 per violation are available without proof of actual harm. The existence of a separate Biometric Privacy Policy referenced but not reproduced in this document requires independent review. JURISDICTION FLAGS: Illinois BIPA creates the highest exposure given its private right of action and per-violation damages structure. Texas CUBI and Washington's biometric privacy statute impose additional state-level obligations. New York City Local Law 144 and other emerging municipal biometric ordinances may apply to retail and studio locations in those jurisdictions. EU/EEA users may have GDPR Article 9 protections applicable to biometric data processing. CONTRACT AND VENDOR IMPLICATIONS: The reference to a separate Biometric Privacy Policy means that vendor assessments and compliance reviews must include that document in scope. B2B customers or employers who offer Peloton as a wellness benefit should assess whether employee biometric data collection through Peloton services creates obligations under their own BIPA compliance frameworks. COMPLIANCE CONSIDERATIONS: Legal teams should obtain and review the Biometric Privacy Policy referenced in this document to assess whether it satisfies BIPA requirements for written consent, retention schedule publication, and destruction protocols. The distinction between physical movement data collected for form feedback and legally defined biometric identifiers should be evaluated against applicable state law definitions. Consent mechanisms for voice data opt-in should be reviewed for compliance with applicable state biometric and wiretapping statutes.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision acknowledges that physical movement and form analysis data may constitute biometric information under applicable state law, creating compliance exposure under Illinois BIPA and similar statutes that impose specific written consent, retention, and destruction requirements. The policy references a separate Biometric Privacy Policy but does not reproduce its terms, requiring review of that document for complete compliance assessment.
Under this clause, the agreement authorizes collection of physical movement characteristics for form analysis and voice data for command recognition; the policy acknowledges these may qualify as biometric information in some jurisdictions and references a separate Biometric Privacy Policy governing those practices. Voice data collected via opt-in is described as not stored by Peloton after use.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Peloton.