Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The statement discloses that Salesforce may collect biometric information, specifically images of facial features for identification purposes, at specified events where the individual has given explicit consent.
This analysis describes what Salesforce's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Salesforce collects a special category of Personal Data (biometric data) at events, requiring explicit consent under GDPR Article 9 and engaging state-level biometric privacy laws such as Illinois BIPA, which impose specific notice, consent, retention, and destruction requirements.
Under this provision, attendees at specified Salesforce events may be asked to provide biometric facial data for identification purposes, subject to explicit consent. The agreement states this collection is limited to specified events and conditioned on explicit consent.
Cross-platform context
See how other platforms handle Biometric Data Collection at Events and similar clauses.
Compare across platforms →Monitoring
Salesforce has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you give your explicit consent and only for specified events, your biometric information, such as an image of your facial features for identification purposesExcerpt from Salesforce's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 9 (special categories of Personal Data), Illinois BIPA (740 ILCS 14), Texas CUBI, Washington My Health MY Data Act, and equivalent biometric privacy statutes in other U.S. states. The FTC and State Attorneys General have authority to act on violations of biometric data requirements. (2) GOVERNANCE EXPOSURE: High. Biometric data collection is subject to heightened regulatory scrutiny and private rights of action in jurisdictions including Illinois. BIPA requires written consent, a publicly available retention policy, and destruction schedules; non-compliance carries statutory damages per violation. (3) JURISDICTION FLAGS: Illinois, Texas, and Washington create the most significant heightened exposure for biometric data collection. EU and UK attendees are protected under GDPR Article 9 explicit consent requirements. Organizations sending employees to Salesforce events should assess whether their data processing agreements and employee consent mechanisms address third-party biometric collection. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and HR teams at organizations sending employees or contractors to Salesforce events should review whether attendance agreements or event terms address biometric data collection, and whether their own employee data agreements accommodate third-party biometric processing. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Salesforce's event-level consent mechanisms meet explicit consent standards under GDPR Article 9 and applicable U.S. state law requirements including written consent, retention schedules, and destruction commitments under BIPA.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that Salesforce collects a special category of Personal Data (biometric data) at events, requiring explicit consent under GDPR Article 9 and engaging state-level biometric privacy laws such as Illinois BIPA, which impose specific notice, consent, retention, and destruction requirements.
Under this provision, attendees at specified Salesforce events may be asked to provide biometric facial data for identification purposes, subject to explicit consent. The agreement states this collection is limited to specified events and conditioned on explicit consent.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Salesforce.