What can I do about this clause?

{'method': 'EMAIL', 'recipient': 'privacy@runwayml.com', 'difficulty': 'MODERATE', 'action_type': 'DELETE_DATA', 'instructions': 'Email privacy@runwayml.com requesting deletion of your biometric data (facial scans and voice data). State your account email address and specify that you are requesting deletion of biometric identifiers. Runway will verify your identity before processing the request.', 'deadline_days': 30, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'FTC', 'reason': 'The FTC has enforcement authority over unfair or deceptive data practices involving sensitive biometric data under FTC Act Section 5, and has brought actions against companies for inadequate biometric data disclosures.', 'complaint_url': 'https://reportfraud.ftc.gov/'}, {'agency': 'State_AG', 'reason': 'State attorneys general in Illinois (BIPA), Texas (CUBI), California (CCPA), and other states have direct enforcement authority over biometric data collection practices.', 'complaint_url': 'https://www.naag.org/find-my-ag/'}

What is the severity of this clause?

ConductAtlas classifies this Biometric Data Collection clause as high severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Do other platforms have similar clauses?

Yes. ConductAtlas has identified similar Biometric Data Collection clauses across approximately 15 other tracked platforms. You can compare how platforms differ on this clause type in the cross-platform comparison view.

Biometric Data Collection — Runway

What it is

When you use Runway's AI video or audio features, the company collects your facial scan and voice data, which are legally classified as biometric data in several US states and carry strong privacy protections.

Consumer impact (what this means for users)

If you use Runway's AI face or voice generation features, your biometric identifiers are collected. If you live in Illinois, Texas, Washington, or other states with biometric privacy laws, you have specific rights including consent, retention limits, and deletion that Runway must honor.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data
Within 30 days
Email privacy@runwayml.com requesting deletion of your biometric data (facial scans and voice data). State your account email address and specify that you are requesting deletion of biometric identifiers. Runway will verify your identity before processing the request.

Why it matters (compliance & risk perspective)

Biometric data like facial scans and voiceprints are uniquely sensitive — unlike a password, you cannot change your face or voice if this data is misused. Several states impose strict consent, retention, and deletion requirements for this type of data.

View original clause language

Biometric data, such as voice data and scans of faces that you submit when you use certain product features to create videos and audio using characteristics like voice and face. Such characteristics may be considered biometric identifiers or biometric information under certain laws including applicable privacy laws. When you choose to use these features, we use any biometric data submitted by you only to provide the service requested by you.

Institutional analysis (Compliance & legal intelligence)

(1) REGULATORY FRAMEWORK: Illinois BIPA 740 ILCS 14/1 et seq. (requires informed written consent before collection, written retention/destruction policy, prohibition on sale or profit from biometric data, private right of action); Texas CUBI Tex. Bus. & Com. Code §503A (consent required before capture of biometric identifiers, enforced by TX AG); Washington My Health Data Act (if voice/face data constitutes health-adjacent data); CCPA §1798.100 and CPRA sensitive personal information provisions (biometric data is 'sensitive personal information' under Cal. Civ. Code §1798.140(ae)(1)(B)); GDPR Art. 9 (biometric data is 'special category' data requiring explicit consent or another Art. 9(2) basis, enforced by EU supervisory authorities). Primary US enforcement: IL AG, TX AG, CA Privacy Protection Agency. (2)

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

FTC

The FTC has enforcement authority over unfair or deceptive data practices involving sensitive biometric data under FTC Act Section 5, and has brought actions against companies for inadequate biometric data disclosures.
File a complaint →
State AG

State attorneys general in Illinois (BIPA), Texas (CUBI), California (CCPA), and other states have direct enforcement authority over biometric data collection practices.
File a complaint →

Provision details

Document information

Document

Runway Privacy Policy

Entity

Runway

Document last updated

April 29, 2026

Tracking information

First tracked

April 30, 2026

Last verified

April 30, 2026

Record ID

CA-P-004248

Document ID

CA-D-00446

Evidence Provenance

Source URL

https://runwayml.com/privacy-policy

Wayback Machine

View archived versions →

SHA-256

abffd085133cb5579dda66c35fe22ffd6d418b7de61e23341f0e752e65e63459

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: Runway | Document: Runway Privacy Policy | Record: CA-P-004248
Captured: 2026-04-30 07:30:40 UTC | SHA-256: abffd085133cb557…
URL: https://conductatlas.com/platform/runway/runway-privacy-policy/biometric-data-collection/
Accessed: May 2, 2026

Classification

Severity

High

Biometric Data Collection