Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement discloses a broad list of sensitive personal data categories collected, including Social Security numbers, biometric data, precise location, text message content, and children's data, and states that without consent these categories are not used for characteristic inference or sold or shared for cross-context behavioral advertising.
This analysis describes what T-Mobile's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the categories of sensitive data T-Mobile collects and the consent conditions limiting their use for advertising purposes, explicitly anchoring the default use restrictions to CCPA regulatory section 7027(m) and defining the boundary between permissible operational use and consent-required advertising use.
Under this clause, T-Mobile collects Social Security numbers, biometric data, precise location, text message content, financial account information, and children's data, and the agreement states these categories will not be used for targeted advertising across websites or apps without separate consumer consent. Consumers may be asked for consent to expand permitted uses of these categories beyond the operational purposes listed.
Cross-platform context
See how other platforms handle Sensitive Personal Data Disclosure and Use Limits and similar clauses.
Compare across platforms →Monitoring
T-Mobile has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We collect the following categories of sensitive personal data (as defined under certain state and other applicable privacy laws): your Social Security number, driver's license, government-issued identification card, passport number, your account log in, financial account information, debit or credit card number in combination with any required security or access code, password, information allowing access to an account, your precise location, what's in your text messages, biometric data, and children's data. Unless you give us consent, we don't collect or use this data to infer characteristics about you and we only use or disclose the data for purposes described in section 7027(m) of the California Consumer Privacy Act Regulations. Unless you give us consent, we don't 'sell' or 'share' sensitive personal data for purposes of 'cross-context behavioral advertising,' which is targeted advertising that tracks your activity across different websites, applications, and services.Excerpt from T-Mobile's Privacy Policy
1) REGULATORY LANDSCAPE: This provision explicitly references CCPA Regulations section 7027(m) as the governing framework for sensitive data use limitations, placing it squarely within CPPA enforcement jurisdiction in California. Sensitive data categories including biometric data engage Illinois BIPA, Washington's My Health MY Data Act (for health-adjacent inferences), and similar state biometric and health data statutes. The collection of text message content engages ECPA as a federal framework. Children's data collection engages COPPA and state children's privacy laws. 2) GOVERNANCE EXPOSURE: High. The breadth of sensitive data categories collected, including Social Security numbers, text message content, biometric data, and children's data in a single consumer wireless context, creates a high-value data aggregation exposure. The consent carve-out for expanded sensitive data use means that any consent solicitation mechanism must satisfy heightened standards under applicable state law. 3) JURISDICTION FLAGS: California creates primary exposure given the explicit CCPA regulatory citation. Illinois BIPA applies to biometric data collection, including face scans and voiceprints referenced in the biometric data category. States with enacted comprehensive privacy laws imposing opt-in consent for sensitive data processing (Colorado, Connecticut, Virginia, Texas) should be assessed. COPPA applies to children's data collection for users under 13. 4) CONTRACT AND VENDOR IMPLICATIONS: Service providers receiving sensitive data categories must be assessed for compliance with CCPA service provider restrictions, which prohibit use of sensitive data for the provider's own commercial purposes. Biometric data vendor agreements require specific contractual protections under BIPA and analogous state laws. Any consent management platform used to solicit consent for expanded sensitive data use should be audited for compliance with applicable state consent standards. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that current consent solicitation mechanisms for expanded sensitive data use meet the specificity and voluntariness requirements of CCPA regulations and applicable state law. A data mapping review should confirm that all sensitive data categories listed are accurately inventoried against actual collection points. The Children's Privacy Notice referenced in this document should be reviewed in conjunction with this provision for COPPA compliance completeness.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the categories of sensitive data T-Mobile collects and the consent conditions limiting their use for advertising purposes, explicitly anchoring the default use restrictions to CCPA regulatory section 7027(m) and defining the boundary between permissible operational use and consent-required advertising use.
Under this clause, T-Mobile collects Social Security numbers, biometric data, precise location, text message content, financial account information, and children's data, and the agreement states these categories will not be used for targeted advertising across websites or apps without separate consumer consent. Consumers may be asked for consent to expand permitted uses of these categories beyond the operational purposes listed.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by T-Mobile.