Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement requires users to submit to identity and location verification at registration and periodically thereafter, including through provision of government-issued identity documents and validation against third-party databases, with users authorizing Upwork and its third-party vendors to conduct these inquiries.
This analysis describes what Upwork's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes Upwork and third-party verification vendors to access and process government-issued identity documents and financial account information, creating data flows to external vendors that may engage data protection obligations under GDPR, UK GDPR, and applicable US state laws, and that require assessment of those vendors' data handling practices.
Interpretive note: Whether verification documents constitute special category data under GDPR and whether biometric processing is involved depends on the specific verification methods Upwork employs, which are not fully described in the document excerpt provided.
The updated terms establish that when clients fund, release, or pay bonuses for multiple milestones in a single transaction session (a 'Bulk Payment Action'), each transaction is treated as a separate, independent, and irrevocable authorization to Payment Escrow. The revised language explicitly states that each transaction receives its own unique transaction identifier, is independently recorded in transaction history, is subject to its own service fees, and is independently subject to dispute assistance rights. Clients must review and confirm all individual transactions before submitting a bulk action. Additionally, the updated Fee and ACH Authorization Agreement states that unused ACH payment methods will be inactivated after 24 months of non-use, with advance notification provided.
View change record →The updated terms establish a new beta feature allowing invited users to connect third-party AI agents to their Upwork accounts. Agents can read information and draft communications (proposals, job posts, messages) without per-action confirmation, but cannot autonomously move money or finalize contracts; those actions require the user to authenticate and confirm on Upwork directly. Users are responsible for all agent actions and must ensure agent-generated content carries mandatory disclosure labels; submitting proposals through agents consumes Connects and incurs fees regardless of whether the user approves the draft-confirm action. You can revoke agent access by visiting the App Authorization page, and these beta terms apply only until you accept replacement terms.
View change record →Upwork's privacy policy previously disclosed that it complied with the U.S. Data Privacy Framework and certified adherence to its Principles regarding how it processes personal data from EU, UK, and Swiss residents. The updated policy removes nearly all of this language, including the explicit commitment to Data Privacy Framework Principles and the statement that those Principles would govern in case of conflict with other policy terms. Users in the EU, UK, and Switzerland no longer have a clear, policy-level statement of the legal framework protecting their data when transferred to the U.S., which may reduce transparency about data protection safeguards. You may contact Upwork to request copies of the data transfer mechanism documents it uses.
View change record →Under this clause, users authorize Upwork to share their personal data including government identity documents and financial account information with third-party verification services, and failure to cooperate with verification requests may result in temporary or permanent restrictions on account features.
Cross-platform context
See how other platforms handle Identity and Location Verification and similar clauses.
Compare across platforms →Monitoring
Upwork has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"When you register for an Account and periodically thereafter, your Account will be subject to verification, including but not limited to validation against third-party databases or the verification of one or more official government or legal documents that confirm your identity, your location, and your ability to act on behalf of your business on Upwork. You authorize Upwork, directly or through third parties, to make any inquiries necessary to validate your identity, your location, and confirm your ownership of your business, email address or financial accounts, subject to applicable law.Excerpt from Upwork's Privacy Policy
(1) REGULATORY LANDSCAPE: Collection and processing of government-issued identity documents engages GDPR provisions on special categories of data depending on the document type, and the transfer of this data to third-party verification vendors requires adequate data processing agreements and transfer mechanisms; in the US, identity verification practices may engage FTC guidance on reasonable data security and state-level biometric data laws such as Illinois BIPA if biometric identifiers are collected as part of the verification process. (2) GOVERNANCE EXPOSURE: Medium. The authorization to conduct third-party database validation against financial accounts and identity documents is operationally standard for marketplace platforms but creates vendor risk exposure that requires assessment of third-party verification providers' data retention and security practices. (3) JURISDICTION FLAGS: EU and UK users face heightened exposure if the verification process involves processing of document data that qualifies as special category data under GDPR; Illinois users face potential exposure if the verification process involves facial recognition or biometric matching, which would engage BIPA requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should assess whether Upwork's third-party identity verification vendors are identified by name or category, whether data processing agreements are in place, and whether those vendors' retention periods for identity document data are disclosed and proportionate. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should map the data flows from identity verification to third-party vendors, assess whether the authorization language constitutes adequate consent under applicable frameworks, and evaluate whether users are informed of which specific third-party vendors receive their identity document data.
This provision authorizes Upwork and third-party verification vendors to access and process government-issued identity documents and financial account information, creating data flows to external vendors that may engage data protection obligations under GDPR, UK GDPR, and applicable US state laws, and that require assessment of those vendors' data handling practices.
Under this clause, users authorize Upwork to share their personal data including government identity documents and financial account information with third-party verification services, and failure to cooperate with verification requests may result in temporary or permanent restrictions on account features.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Upwork.