Spotify may collect a photo of your face and a photo of your ID document to verify your age through a third-party provider. Spotify says this data is deleted immediately after the check.
If you use the Age Check feature, a photo of your face and potentially your government ID will be processed by a third-party provider — this is highly sensitive biometric-adjacent data, and while Spotify states it is deleted immediately, the third-party provider's processing is governed by their own policies.
How other platforms handle this
We, and our analytics and advertising providers, use these technologies to collect personal information (such as the pages you visit, the links you click on, and similar usage information, identifiers, and device information) when you use our Services, including personal information about your onlin...
Your browsing activity may be tracked across different websites and different devices or apps. For example, we may attempt to match your browsing activity on your mobile device with your browsing activity on your computer. To do this, we may analyze your browsing patterns, geo-location and device id...
We may receive information about you from third parties, such as social media platforms, identity verification services, and other users who share content about you when using our services.
Collection of facial images and identity documents is among the most sensitive categories of personal data and may trigger biometric privacy laws in Illinois, Texas, and other states, even if the data is immediately deleted.
1) REGULATORY FRAMEWORK: This provision potentially implicates Illinois BIPA (740 ILCS 14/1 et seq.) which requires informed written consent before collecting biometric identifiers including facial geometry; Texas CUBI (Tex. Bus. & Com. Code §503.001) which prohibits capturing biometric identifiers without informed consent; the Washington My Health MY Data Act (SB 1155) as it relates to biometric health data; CCPA/CPRA sensitive personal information provisions (Cal. Civ. Code §1798.121) which classify biometric information as sensitive and require a separate opt-in or right to limit use; and COPPA (15 U.S.C. §6501) for any minor users who undergo age verification. The FTC and state AGs have enforcement authority. Illinois BIPA is privately enforceable with statutory damages of $1,000–$5,000 per violation. 2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.