Spotify may collect a photo of your face and a photo of your ID document to verify your age through a third-party provider. Spotify says this data is deleted immediately after the check.
This analysis describes what Spotify's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision establishes the operational scope and retention parameters for biometric and identity document data processed through Spotify's age verification mechanism. By restricting retention to the duration of the verification process and requiring prior consent and third-party notice, the clause defines the conditions under which sensitive personal data may be collected and processed.
If you use the Age Check feature, a photo of your face and potentially your government ID will be processed by a third-party provider — this is highly sensitive biometric-adjacent data, and while Spotify states it is deleted immediately, the third-party provider's processing is governed by their own policies.
How other platforms handle this
You may give us your Identity Data, Contact Data, Financial Data, Profile Data, and other information by filling in forms or by corresponding with us by post, phone, e-mail or otherwise.
TAO Toolkit releases that collect data, collect it for the following purposes: (a) to properly configure and optimize products for use with Software; (b) to deliver content or service through the Software; and (c) to improve NVIDIA products...
Some of our ad partners may also enable us to collect similar data directly from their website or app by integrating our or our affiliates' advertising technology.
"Age Check Data is the data you provide if you use an Age Check powered by a third party provider on Spotify ('Age Check'). This includes: Facial age estimation: a photo of your face which is used to estimate your age. Identity document verification: photos of your face and ID which are used to confirm your age and to verify that the ID belongs to you. Where Age Check Data is collected, we will obtain your consent and provide notice of the third party policies that apply to the processing of such data. All Age Check Data is deleted immediately after the Age Check.Excerpt from Spotify's Privacy Policy
1) REGULATORY FRAMEWORK: This provision potentially implicates Illinois BIPA (740 ILCS 14/1 et seq.) which requires informed written consent before collecting biometric identifiers including facial geometry; Texas CUBI (Tex.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The provision establishes the operational scope and retention parameters for biometric and identity document data processed through Spotify's age verification mechanism. By restricting retention to the duration of the verification process and requiring prior consent and third-party notice, the clause defines the conditions under which sensitive personal data may be collected and processed.
If you use the Age Check feature, a photo of your face and potentially your government ID will be processed by a third-party provider — this is highly sensitive biometric-adjacent data, and while Spotify states it is deleted immediately, the third-party provider's processing is governed by their own policies.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Spotify.