Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Squarespace Payments users may be required to submit a selfie photograph and a government-issued identity document; a third-party vendor then creates a biometric facial geometry scan to compare the two images for identity verification. The policy states that Squarespace itself does not create, store, or access the resulting biometric data.
This analysis describes what Squarespace's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses that a third-party vendor processes biometric data derived from user-submitted photographs and government documents, with the vendor's data practices governed outside this policy. The scope of vendor obligations regarding biometric data retention, deletion, and onward transfer is not detailed in this document.
Interpretive note: The policy asserts Squarespace does not create or store biometric data, but whether this assertion fully resolves legal obligations under BIPA or GDPR when Squarespace directs vendor processing depends on jurisdiction-specific interpretation and enforcement context.
Under this clause, Payments Services users who are required to complete identity verification must submit photographs and government identity documents that a vendor uses to generate biometric scan data. The agreement states that Squarespace does not retain or access this biometric data, but the vendor's handling is governed by separate agreements not reproduced here.
Cross-platform context
See how other platforms handle Biometric Identity Verification via Third-Party Vendor and similar clauses.
Compare across platforms →Monitoring
Squarespace has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you use the Payments Services, you may be required to provide us with additional information to verify your identity, including a photograph of you captured by you during the verification process and a copy of an official government document which includes a different photograph of you. When you're required to provide this additional information, our vendors may create a biometric scan of your facial geometry based on these two photographs in order to compare them and verify that you are the same individual whose photograph is on your government document. However, Squarespace does not create, store or otherwise have access to any such biometric data.Excerpt from Squarespace's Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington My Health MY Data Act, as well as GDPR Article 9 governing special categories of personal data including biometric data processed for identification purposes. Enforcement authorities include the Illinois Attorney General, Texas Attorney General, and EU/EEA supervisory authorities. The provision's assertion that Squarespace does not create or store biometric data does not necessarily resolve BIPA or GDPR obligations if Squarespace directs or facilitates biometric processing by a vendor acting on its behalf. 2. GOVERNANCE EXPOSURE: High. The involvement of a third-party vendor in biometric processing creates a data supply chain where the vendor's privacy practices, retention schedules, and deletion procedures are material to Squarespace's compliance posture under state biometric privacy laws and GDPR. The policy does not specify the vendor, the retention period for biometric scans, or the deletion schedule. 3. JURISDICTION FLAGS: Illinois BIPA creates a private right of action with statutory damages and has been the basis for significant class action litigation; Texas CUBI is enforced by the state attorney general. EU/EEA users are protected under GDPR Article 9, which requires explicit consent for biometric processing. The policy states that explicit consent is obtained where required. California users should evaluate this provision in the context of CPRA's sensitive personal information category for biometric data. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should verify that the vendor agreement with the identity verification vendor (not named in this policy) includes appropriate data processing terms covering BIPA-compliant written release, defined retention and destruction schedules, and GDPR Article 28 processor obligations. The policy names Sift and Plaid as Payments Services vendors but does not specifically identify the biometric verification vendor. 5. COMPLIANCE CONSIDERATIONS: Legal teams should confirm that consent mechanisms for biometric verification meet BIPA's written release requirements for Illinois users, GDPR's explicit consent standard for EEA users, and CPRA's consent requirement for California users. A data mapping exercise should trace the biometric data from collection through vendor processing to deletion and confirm the vendor's deletion timeline. Contract review should verify that Squarespace's DPA with the biometric vendor aligns with applicable state and federal requirements.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision discloses that a third-party vendor processes biometric data derived from user-submitted photographs and government documents, with the vendor's data practices governed outside this policy. The scope of vendor obligations regarding biometric data retention, deletion, and onward transfer is not detailed in this document.
Under this clause, Payments Services users who are required to complete identity verification must submit photographs and government identity documents that a vendor uses to generate biometric scan data. The agreement states that Squarespace does not retain or access this biometric data, but the vendor's handling is governed by separate agreements not reproduced here.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Squarespace.