Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Uber collects facial images and derived biometric identifiers from drivers to verify your identity, which constitutes biometric data under several state laws with strict handling requirements.
This analysis describes what Uber's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The collection and processing of biometric data serves as a mechanism for identity authentication and fraud detection within Uber's driver and delivery operations. This establishes the institutional basis for biometric data handling in the context of platform participant verification.
This provision means Uber captures and processes your facial geometry or comparable biometric identifiers as a condition of using the platform, which in some US states requires explicit written consent and gives you rights to request destruction of that data.
How other platforms handle this
We may attempt to verify your employment history or status through various methods, including third-party integrations or services. We may also utilize signals we may receive from your current or former employer.
authorize ZipRecruiter to connect your account to the account of a "Connected Site" (e.g., Google, LinkedIn, Monster, Facebook or Twitter), we may be able to access information you have provided to the Connected Site...
telemetry information collected includes: (i) microservice settings, (ii) usage data and (iii) hardware environment.
Monitoring
Uber has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Uber collects biometric data or biometric information in the form of photos and facial verification data from drivers and delivery people for identity verification and fraud prevention purposes.Excerpt from Uber's Privacy Notice (Drivers and Delivery People)
(1) REGULATORY LANDSCAPE: Biometric data collection directly engages the Illinois Biometric Information Privacy Act (BIPA), Texas Capture or Use of Biometric Identifier Act (CUBI), and Washington's biometric privacy law. BIPA provides a private right of action and has generated substantial class action litigation. Under GDPR, biometric data is a special category requiring explicit consent or another Article 9 exception. (2) GOVERNANCE EXPOSURE: High. BIPA litigation risk is significant given that Illinois courts have found per-violation statutory damages of $1,000 to $5,000 applicable in class contexts. The notice does not specify a biometric data retention schedule or destruction policy in the text provided, which is a BIPA compliance requirement. (3) JURISDICTION FLAGS: Illinois creates the highest exposure due to BIPA's private right of action. Texas and Washington have similar statutes but enforcement is primarily regulatory rather than private. EU/EEA drivers are protected by GDPR Article 9 requiring explicit consent for biometric processing. (4) CONTRACT AND VENDOR IMPLICATIONS: Third-party identity verification vendors processing biometric data on Uber's behalf must be covered by data processing agreements that address biometric-specific retention, destruction, and security obligations. Procurement teams should verify that vendor agreements include BIPA-compliant terms for Illinois drivers. (5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that written consent is obtained prior to biometric collection in applicable jurisdictions, that a publicly available retention schedule and destruction policy exists as required by BIPA, and that data subject requests for biometric data deletion can be fulfilled within required timeframes.
Regulatory citations, enforcement risk, and due diligence action items.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
The collection and processing of biometric data serves as a mechanism for identity authentication and fraud detection within Uber's driver and delivery operations. This establishes the institutional basis for biometric data handling in the context of platform participant verification.
This provision means Uber captures and processes your facial geometry or comparable biometric identifiers as a condition of using the platform, which in some US states requires explicit written consent and gives you rights to request destruction of that data.
ConductAtlas has identified this type of provision across 304 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Uber.