The agreement requires users to submit to identity and location verification at registration and periodically thereafter, including through provision of government-issued identity documents and validation against third-party databases, with users authorizing Upwork and its third-party vendors to conduct these inquiries.
This analysis describes what Upwork's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes Upwork and third-party verification vendors to access and process government-issued identity documents and financial account information, creating data flows to external vendors that may engage data protection obligations under GDPR, UK GDPR, and applicable US state laws, and that require assessment of those vendors' data handling practices.
Interpretive note: Whether verification documents constitute special category data under GDPR and whether biometric processing is involved depends on the specific verification methods Upwork employs, which are not fully described in the document excerpt provided.
The updated terms establish a new beta feature allowing invited users to connect third-party AI agents to their Upwork accounts. Agents can read information and draft communications (proposals, job posts, messages) without per-action confirmation, but cannot autonomously move money or finalize contracts; those actions require the user to authenticate and confirm on Upwork directly. Users are responsible for all agent actions and must ensure agent-generated content carries mandatory disclosure labels; submitting proposals through agents consumes Connects and incurs fees regardless of whether the user approves the draft-confirm action. You can revoke agent access by visiting the App Authorization page, and these beta terms apply only until you accept replacement terms.
View change record →Upwork's privacy policy previously disclosed that it complied with the U.S. Data Privacy Framework and certified adherence to its Principles regarding how it processes personal data from EU, UK, and Swiss residents. The updated policy removes nearly all of this language, including the explicit commitment to Data Privacy Framework Principles and the statement that those Principles would govern in case of conflict with other policy terms. Users in the EU, UK, and Switzerland no longer have a clear, policy-level statement of the legal framework protecting their data when transferred to the U.S., which may reduce transparency about data protection safeguards. You may contact Upwork to request copies of the data transfer mechanism documents it uses.
View change record →The updated policy now explicitly states that Upwork complies with the U.S. Data Privacy Framework and has certified to the U.S. Department of Commerce that it adheres to DPF principles when processing personal data from EU, UK, and Swiss residents. The policy establishes that if any conflict exists between Upwork's privacy policy and DPF principles, the DPF principles will govern. This creates an explicit legal hierarchy for data protection standards applicable to residents of those jurisdictions. Users from affected regions can visit https://www.dataprivacyframework.gov/ to view Upwork's certification and learn more about the DPF program.
View change record →Under this clause, users authorize Upwork to share their personal data including government identity documents and financial account information with third-party verification services, and failure to cooperate with verification requests may result in temporary or permanent restrictions on account features.
Cross-platform context
See how other platforms handle Identity and Location Verification and similar clauses.
Compare across platforms →"When you register for an Account and periodically thereafter, your Account will be subject to verification, including but not limited to validation against third-party databases or the verification of one or more official government or legal documents that confirm your identity, your location, and your ability to act on behalf of your business on Upwork. You authorize Upwork, directly or through third parties, to make any inquiries necessary to validate your identity, your location, and confirm your ownership of your business, email address or financial accounts, subject to applicable law.Excerpt from Upwork's Privacy Policy
(1) REGULATORY LANDSCAPE: Collection and processing of government-issued identity documents engages GDPR provisions on special categories of data depending on the document type, and the transfer of this data to third-party verification vendors requires adequate …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision authorizes Upwork and third-party verification vendors to access and process government-issued identity documents and financial account information, creating data flows to external vendors that may engage data protection obligations under GDPR, UK GDPR, and applicable US state laws, and that require assessment of those vendors' data handling practices.
Under this clause, users authorize Upwork to share their personal data including government identity documents and financial account information with third-party verification services, and failure to cooperate with verification requests may result in temporary or permanent restrictions on account features.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Upwork.