Spotify may take a photo of your face to estimate your age or verify your identity, using a third-party provider. The policy states this photo is deleted immediately after the check is complete.
This analysis describes what Spotify's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The collection of facial photographs for age estimation constitutes biometric data processing under several U.S. state laws, and the involvement of a third-party provider means Spotify is not the sole party handling this data, raising questions about that provider's own data practices.
Interpretive note: Whether the act of using an Age Check feature constitutes legally adequate consent under BIPA and analogous biometric statutes is jurisdiction-dependent and subject to enforcement interpretation.
If you use a feature subject to an Age Check, Spotify's third-party provider may process a photograph of your face for facial age estimation or identity verification; the policy states this Age Check Data is deleted immediately after the check, but the third-party provider's handling of that data is governed by their own practices and Spotify's contractual arrangements with them.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
"Age Check Data is the data you provide if you (i) choose to use a feature that is subject to an Age Check or (ii) are a parent or legal guardian providing parental consent for a Managed Account ('Age Check'). Examples of Age Check methods we use, which are powered by a third party provider, are: identity document verification: a photo of your identity document is used to confirm your age. In some cases, we may also use a photo of your face to verify that your ID belongs to you; facial age estimation: a photo of your face which is used to estimate your age. All Age Check Data is deleted immediately after the Age Check.Excerpt from Spotify's Privacy Policy
REGULATORY LANDSCAPE: Collection of facial photographs for biometric age estimation implicates the Illinois Biometric Information Privacy Act (BIPA), which requires informed written consent before collecting biometric identifiers including facial geometry, as well as analogous statutes …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The collection of facial photographs for age estimation constitutes biometric data processing under several U.S. state laws, and the involvement of a third-party provider means Spotify is not the sole party handling this data, raising questions about that provider's own data practices.
If you use a feature subject to an Age Check, Spotify's third-party provider may process a photograph of your face for facial age estimation or identity verification; the policy states this Age Check Data is deleted immediately after the check, but the third-party provider's handling of that data is governed by their own practices and Spotify's contractual arrangements with them.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Spotify.