Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that StockX collects facial geometry biometric data through a third-party provider named Persona for identity verification and fraud prevention, with user consent sought prior to collection, and that Persona may use collected biometric data to improve its own verification services.
This analysis describes what StockX's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that biometric facial geometry data is collected by a named third party (Persona) and that Persona retains authority to use that data for its own service improvement purposes, meaning biometric data collected in connection with StockX identity verification may be processed by Persona independently of the original verification purpose. Compliance teams should evaluate whether this arrangement satisfies written consent, retention, and third-party use limitation requirements under applicable biometric privacy statutes.
Interpretive note: The extent to which Persona's use of biometric data for service improvement satisfies consent requirements under applicable biometric statutes depends on the specific language of the consent presented to users at the point of collection and the jurisdiction of the affected user.
The updated policy authorizes StockX to share and sell personal information to a broader range of recipients than previously disclosed. Specifically, the policy now explicitly permits sharing or selling personal data, including identifiers, transaction data, and browsing behavior, to Live Sellers on the Live Shopping Platform, Sellers on the Listings Marketplace, and third-party data brokers. The prior version limited disclosures to 'sharing' with 'StockX Verified Sellers' without explicit reference to data sales or data brokers. Under the revised terms, data sale and sharing is now standard practice for analytics, advertising, and marketplace partners. The policy does not describe a consumer opt-out mechanism for this data sharing or selling.
View change record →Under this clause, users who proceed with identity verification on StockX will have facial geometry biometric data collected and processed by Persona, which the policy states may use that data to improve its own verification services. The policy states that declining to provide biometric data may result in limited or restricted access to certain StockX services.
Cross-platform context
See how other platforms handle Biometric Data Collection via Third-Party Provider Persona and similar clauses.
Compare across platforms →Monitoring
StockX has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may have your Biometric Data collected under certain circumstances to identify and authenticate you for purposes of security and fraud prevention. Biometric Data in this context consists of facial recognition data composed of mathematical representations of your facial geometry. We will seek your consent before having your Biometric Data collected. If you do not consent to our collection of your Biometric Data, your use of our Services may be limited or restricted. We collect this Biometric Data through our third-party service provider of identity verification services, Persona. Persona captures a photo of your ID and your face and compares the facial geometry extracted from the photos of your ID and your face to verify your identity. Persona does not use your Biometric Data for any purpose other than to verify your identity, to improve its verification services, and/or for fraud prevention.Excerpt from StockX's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), the Washington My Health MY Data Act, and analogous state biometric privacy statutes. BIPA in particular requires written consent, a publicly available retention and destruction schedule, and prohibits profit from biometric data. Enforcement authorities include State Attorneys General and, under BIPA, private plaintiffs. The CCPA's treatment of biometric information as sensitive personal information is also engaged. 2) GOVERNANCE EXPOSURE: High. The disclosure that Persona may use biometric facial geometry to improve its own verification services creates potential exposure under BIPA and analogous statutes that restrict third-party use of biometric data beyond the original consent purpose. The policy references a separate Persona biometric privacy practices page for retention period details, meaning StockX's own policy does not contain a specific biometric data retention schedule. 3) JURISDICTION FLAGS: Illinois users face the highest exposure given BIPA's private right of action and statutory damages structure. Texas and Washington state users are subject to analogous statutes enforced by their respective State Attorneys General. California residents may exercise CCPA rights over biometric information as sensitive personal information. Global users may have additional rights under GDPR Article 9 governing special category data. 4) CONTRACT AND VENDOR IMPLICATIONS: The Persona data processing arrangement should be evaluated to confirm that a Data Processing Agreement is in place, that Persona's independent use of biometric data for service improvement is within the scope of the consent obtained from StockX users, and that retention and deletion obligations are contractually specified. The policy's reference to a separate Persona privacy page for retention details may create a gap in StockX's direct disclosure obligations under applicable statutes. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the consent mechanism presented to users prior to biometric data collection to confirm it meets written consent requirements under BIPA and analogous statutes. A specific biometric data retention and destruction schedule should be assessed for inclusion in StockX's own policy documentation. The scope of Persona's permitted use of biometric data for service improvement should be evaluated against the consent language presented to users.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that biometric facial geometry data is collected by a named third party (Persona) and that Persona retains authority to use that data for its own service improvement purposes, meaning biometric data collected in connection with StockX identity verification may be processed by Persona independently of the original verification purpose. Compliance teams should evaluate whether this arrangement satisfies …
Under this clause, users who proceed with identity verification on StockX will have facial geometry biometric data collected and processed by Persona, which the policy states may use that data to improve its own verification services. The policy states that declining to provide biometric data may result in limited or restricted access to certain StockX services.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by StockX.