The policy discloses that creating an avatar on Synthesia requires processing biometric data including facial geometry and voiceprints, classified as special category data under GDPR and as biometric identifiers under the Illinois Biometric Information Privacy Act. Processing occurs for avatar generation, identity verification, fraud prevention, and AI model fine-tuning.
This analysis describes what Synthesia's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that avatar creation constitutes biometric data processing subject to heightened legal obligations under GDPR Article 9 and the Illinois Biometric Information Privacy Act, requiring explicit consent as a derogation and compliance with jurisdiction-specific retention, disclosure, and prohibition-on-sale requirements. Enterprise customers deploying Synthesia for employee avatar creation should assess their own obligations as data controllers under these frameworks.
Under this provision, users who proceed with avatar creation consent to processing of their facial geometry and voiceprint data, which the policy classifies as biometric data under applicable law. The agreement states that users who decline consent will not have biometric data extracted or processed, but will also be unable to generate an avatar using the automated process, though a manual Studio Avatar option is described as an alternative.
Cross-platform context
See how other platforms handle Biometric Data Collection and Processing and similar clauses.
Compare across platforms →"Avatar submissions and Biometric Data Sample and Verification Recording by their very nature include unique information relating to the physical characteristics of a natural person, such as facial images and voice data. Avatar creation features require processing of the facial geometry and/or voiceprint from each of the Sample and Verification Recording. Certain steps in creating an Avatar involve the processing of data considered "biometric data", "biometric information", "biometric identifier", "sensitive personal data", or "special category of personal data" under applicable data protection laws in certain jurisdictions (including but not limited to the Illinois Biometric Privacy Act and GDPR). We will refer to this information throughout this Privacy Policy as "Biometric Data" for consistency.Excerpt from Synthesia's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that avatar creation constitutes biometric data processing subject to heightened legal obligations under GDPR Article 9 and the Illinois Biometric Information Privacy Act, requiring explicit consent as a derogation and compliance with jurisdiction-specific retention, disclosure, and prohibition-on-sale requirements. Enterprise customers deploying Synthesia for employee avatar creation should assess their own obligations as data controllers under these frameworks.
Under this provision, users who proceed with avatar creation consent to processing of their facial geometry and voiceprint data, which the policy classifies as biometric data under applicable law. The agreement states that users who decline consent will not have biometric data extracted or processed, but will also be unable to generate an avatar using the automated process, though a …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Synthesia.