The policy states that Samsung's services may automatically generate biometric data including face-clustering data that groups images of the same face across photos stored on the device, and that this data remains on-device and is not accessed, transferred to, or shared by Samsung. Deletion of this data is the user's responsibility through device settings, factory reset, or photo deletion.
This analysis describes what Samsung's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The automatic generation of face-clustering data from stored photos may implicate state biometric privacy laws such as the Illinois Biometric Information Privacy Act (BIPA), which imposes specific notice, consent, and retention requirements for biometric identifiers generated from facial geometry. The policy's assertion that Samsung does not access this data limits Samsung's ability to fulfill deletion requests on behalf of users.
Interpretive note: Whether automatic on-device generation of face-clustering data constitutes biometric data collection under BIPA or analogous statutes is a question subject to ongoing litigation and regulatory interpretation; the policy's assertion that Samsung does not access the data does not resolve the notice and consent question under all applicable state frameworks.
The updated policy expands Samsung's data collection authority to include device registration, verification for repairs, and configuration of device settings. The terms now explicitly state that Samsung may collect card and transaction information if you apply for a Samsung-branded payment card. Samsung clarified that it will only send personalized marketing when you have provided consent, where required by law. The policy removed its previous statement that defective devices are wiped of personal information before analysis; the updated terms now state Samsung will analyze returned defective devices without that explicit pre-analysis data deletion commitment. For US residents, the policy now discloses rights to opt out of sale of personal information, sharing for cross-context behavioral advertising, targeted advertising processing, sensitive data collection or processing, and to request lists of third parties receiving your information.
View change record →The policy discloses that Samsung services may automatically generate face-clustering biometric data on-device without explicit user initiation, and that this data persists unless the user clears the device cache, performs a factory reset, or deletes the relevant photos. Because Samsung states it does not access this data, users must manage its deletion directly through device-level actions.
Cross-platform context
See how other platforms handle On-Device Biometric Data and Face-Clustering and similar clauses.
Compare across platforms →"Samsung also may generate certain biometric data automatically when certain Services are used (e.g., Samsung's face-clustering technology may group together images of the same face from different photographs stored on your device ("Face-Clustering Data")). This biometric data remains on your device and is not transferred to or accessed or obtained by Samsung. Samsung does not share this biometric data with third parties. Face-Clustering Data will remain on your device unless you clear the cache in your system settings, reset your device to its factory setting, or delete the relevant photos from your device. You can delete your registered biometric data or your Bixby Voice wake-up command from your device at any time in the applicable settings. Because Samsung does not have access to this data, Samsung cannot delete it for you.Excerpt from Samsung's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The automatic generation of face-clustering data from stored photos may implicate state biometric privacy laws such as the Illinois Biometric Information Privacy Act (BIPA), which imposes specific notice, consent, and retention requirements for biometric identifiers generated from facial geometry. The policy's assertion that Samsung does not access this data limits Samsung's ability to fulfill deletion requests on behalf of users.
The policy discloses that Samsung services may automatically generate face-clustering biometric data on-device without explicit user initiation, and that this data persists unless the user clears the device cache, performs a factory reset, or deletes the relevant photos. Because Samsung states it does not access this data, users must manage its deletion directly through device-level actions.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Samsung.