Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Uber collects copies of your government-issued ID and in some regions uses facial recognition or photo matching technology to confirm your identity before or during platform use.
This analysis describes what Uber's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Facial image data and government ID copies constitute sensitive personal data in multiple jurisdictions, and facial recognition or matching may qualify as biometric data under laws such as Illinois BIPA, triggering consent requirements and restrictions on retention and sharing.
Interpretive note: The notice does not specify which markets use facial recognition versus document-only verification, creating ambiguity about which drivers are subject to biometric data collection and which regulatory frameworks apply.
The notice states that Uber collects government-issued identification and may collect facial images for identity verification, which in several US states and EU member states constitutes biometric or special category personal data subject to heightened protections and explicit consent requirements.
How other platforms handle this
Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.
When you exercise any of your applicable legal rights to access, amend, or delete your personal information, we may request additional information from you for the purpose of confirming your identity.
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
Monitoring
Uber has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Uber collects identity verification data, including government-issued identification documents such as a driver's license, and may use identity verification technologies including facial recognition or facial matching in some markets to verify that the driver or delivery person operating the account is the registered account holder.Excerpt from Uber's Privacy Notice (Drivers and Delivery People)
1) REGULATORY LANDSCAPE: Collection of facial images for identity verification engages Illinois BIPA (which requires informed written consent and prohibits profit from biometric data), Texas CUBI, Washington's My Health MY Data Act where applicable, GDPR Article 9 (biometric data as special category), and CCPA/CPRA sensitive personal information categories. Enforcement authorities include state Attorneys General, the Illinois courts (BIPA is privately actionable), and EU supervisory authorities. 2) GOVERNANCE EXPOSURE: High. BIPA litigation exposure is significant; Illinois courts have seen substantial class action activity involving facial recognition and photo matching technologies used by gig economy platforms. The notice does not specify which markets use facial recognition versus simpler document verification, creating ambiguity about scope. 3) JURISDICTION FLAGS: Illinois creates the highest litigation exposure due to BIPA's private right of action and statutory damages. EU and UK drivers have GDPR Article 9 rights requiring explicit consent or another qualifying basis for biometric data processing. Texas and Washington also have biometric privacy statutes with regulatory enforcement mechanisms. 4) CONTRACT AND VENDOR IMPLICATIONS: If third-party identity verification vendors process facial images on Uber's behalf, data processing agreements must address BIPA, GDPR Article 28, and equivalent requirements. Vendor assessments should confirm data retention and deletion practices for facial images. 5) COMPLIANCE CONSIDERATIONS: Legal teams should audit which markets deploy facial recognition or matching, document the lawful basis in each jurisdiction, confirm consent mechanisms meet BIPA and GDPR standards, and assess whether data retention schedules for facial images are implemented and auditable.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
Facial image data and government ID copies constitute sensitive personal data in multiple jurisdictions, and facial recognition or matching may qualify as biometric data under laws such as Illinois BIPA, triggering consent requirements and restrictions on retention and sharing.
The notice states that Uber collects government-issued identification and may collect facial images for identity verification, which in several US states and EU member states constitutes biometric or special category personal data subject to heightened protections and explicit consent requirements.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Uber.