Spotify may take a photo of your face or your ID document to verify your age for certain features. These images are handled by a third-party provider and Spotify says they are deleted immediately after the check.
Your facial image or government-issued ID photo may be captured and processed by a third-party provider when you access age-restricted features — even though Spotify states the data is deleted immediately, the moment of collection itself triggers legal protections in states like Illinois and Texas.
Cross-platform context
See how other platforms handle Biometric Age Check Data Collection and similar clauses.
Compare across platforms →Collecting facial images and identity documents is among the most sensitive forms of data collection and triggers specific biometric privacy laws in several U.S. states that require written consent and carry statutory damages per violation.
(1) REGULATORY FRAMEWORK: Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14/1 et seq.) requires written informed consent and a publicly available retention/destruction schedule before collecting biometric identifiers including facial geometry. Texas Capture or Use of Biometric Identifier Act (CUBI, Tex. Bus. & Com. Code §503.001) similarly requires informed consent before capture. Washington My Health MY Data Act and several other state laws may also apply. FTC Act Section 5 governs unfair or deceptive biometric data practices at the federal level. The FTC and State AGs are primary enforcement authorities. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.