Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The notice states that Uber collects facial images and processes biometric data from drivers in applicable markets for identity verification during onboarding and ongoing real-time checks while using the platform.
This analysis describes what Uber's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision requires collection and processing of biometric identifiers, which are classified as special category data under GDPR Article 9 and sensitive personal information under CCPA/CPRA, and as biometric identifiers under Illinois BIPA and similar statutes, triggering heightened consent, retention, and security obligations in multiple jurisdictions.
Interpretive note: The specific markets where biometric facial verification is collected are not exhaustively enumerated in the notice; applicable legal basis under GDPR and consent mechanism adequacy under BIPA require jurisdiction-specific verification.
This provision establishes that drivers in applicable markets are subject to facial biometric data collection both at onboarding and during active platform use; under Illinois BIPA and similar statutes, this requires written informed consent and a publicly available retention and destruction schedule.
How other platforms handle this
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
Monitoring
Uber has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Uber collects biometric data from drivers and delivery people in certain markets. This includes facial verification images collected during the account registration process and through real-time ID checks during the use of the Uber apps, to help verify that the right person is using the account.Excerpt from Uber's Privacy Notice (Drivers and Delivery People)
1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 9 (special categories of personal data requiring explicit consent or another qualifying basis), CCPA/CPRA's sensitive personal information framework, Illinois BIPA (740 ILCS 14), Texas CUBI, Washington My Health MY Data Act (where biometric data overlaps with health data definitions), and potentially other state biometric privacy statutes. Enforcement authorities include the Irish DPC (EU lead), California Privacy Protection Agency, and Illinois AG. The GDPR Article 9 requirement for explicit consent or a qualifying derogation must be documented; legitimate interests is generally not available for biometric data processing under GDPR. 2) GOVERNANCE EXPOSURE: High. Biometric data collection for workforce identity verification has been the subject of significant BIPA class action litigation in Illinois. The notice does not specify in-app the retention schedule or destruction timeline for biometric data, which is a specific BIPA requirement. Failure to maintain and publish a compliant retention schedule creates material litigation exposure. 3) JURISDICTION FLAGS: Illinois (BIPA — written consent, retention schedule, no profit from biometric data), Texas (CUBI — similar consent and destruction requirements), Washington, EU/EEA (GDPR Article 9 explicit consent or qualifying derogation required), California (CPRA sensitive personal information consent and opt-out rights). Processing biometric data of drivers operating across multiple US states creates multi-jurisdictional compliance obligations. 4) CONTRACT AND VENDOR IMPLICATIONS: Third-party vendors performing facial verification on Uber's behalf (such as identity verification vendors) must be assessed for compliance with applicable biometric privacy statutes. Data processing agreements with such vendors should specify retention limits, destruction timelines, and prohibited secondary uses. Procurement teams should confirm vendor subprocessor agreements satisfy GDPR Article 28 requirements. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that written consent for biometric data collection is obtained prior to collection in Illinois, Texas, and Washington; that a publicly available biometric data retention and destruction policy exists and is followed; that GDPR Article 9 legal basis documentation is in place for EU driver populations; and that CPRA-compliant disclosure and consent flows are implemented for California drivers.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision requires collection and processing of biometric identifiers, which are classified as special category data under GDPR Article 9 and sensitive personal information under CCPA/CPRA, and as biometric identifiers under Illinois BIPA and similar statutes, triggering heightened consent, retention, and security obligations in multiple jurisdictions.
This provision establishes that drivers in applicable markets are subject to facial biometric data collection both at onboarding and during active platform use; under Illinois BIPA and similar statutes, this requires written informed consent and a publicly available retention and destruction schedule.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Uber.