Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Venmo collects face scan data from users who provide consent through the in-app user experience, for the stated purposes of account authentication and fraud and risk management.
This analysis describes what Venmo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes collection of biometric identifiers in the form of face scans, a category of data that is subject to specific statutory requirements in several U.S. states including Illinois, Texas, and Washington. The consent mechanism is described as occurring within the user experience, but the policy does not specify the form, timing, or revocability of that consent.
Interpretive note: The policy does not specify the form, timing, or revocability of biometric consent, nor does it identify whether a standalone biometric retention schedule exists, creating uncertainty about compliance with state biometric statutes.
Under this clause, Venmo collects face scan data from users who consent within the app, retaining it under the same 10-year post-relationship retention schedule stated elsewhere in the policy. The agreement does not specify a standalone mechanism for users to withdraw biometric consent or request deletion of face scan data independently of a full account deletion request.
Cross-platform context
See how other platforms handle Biometric Face Scan Collection and similar clauses.
Compare across platforms →Monitoring
Venmo has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Biometric Information - when you consent in the user experience, we collect face scans to authenticate your account and manage fraud and risk.Excerpt from Venmo's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and the Washington My Health My Data Act to the extent facial recognition data constitutes health-adjacent biometric data. The FTC also has general authority over unfair or deceptive data practices. BIPA in particular requires a written policy, informed written consent, and a defined retention schedule for biometric identifiers, with a private right of action. 2) GOVERNANCE EXPOSURE: High for Illinois, Texas, and Washington user populations. The policy states consent is obtained in the user experience but does not specify that a written biometric retention policy is published or that retention schedules specific to biometric data are disclosed, which may create exposure under BIPA's specific requirements. 3) JURISDICTION FLAGS: Illinois BIPA creates the highest exposure, as it includes a private right of action and requires explicit written consent and a publicly available biometric retention and destruction schedule. Texas CUBI and Washington regulations create additional compliance obligations. The policy's general 10-year retention schedule may not satisfy state biometric-specific retention and destruction requirements. 4) CONTRACT AND VENDOR IMPLICATIONS: If biometric processing involves third-party vendors (such as facial recognition service providers), those vendors may be independently subject to BIPA and similar statutes. The policy does not identify which vendors process biometric data or whether vendor contracts include BIPA-compliant data handling provisions. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the in-app consent mechanism for biometric collection satisfies BIPA's written consent requirements, confirm that a separate biometric data retention and destruction schedule is published or available to users, assess whether third-party vendors processing face scan data have executed BIPA-compliant data processing agreements, and evaluate whether biometric data is subject to the same 10-year retention period or a separate schedule.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes collection of biometric identifiers in the form of face scans, a category of data that is subject to specific statutory requirements in several U.S. states including Illinois, Texas, and Washington. The consent mechanism is described as occurring within the user experience, but the policy does not specify the form, timing, or revocability of that consent.
Under this clause, Venmo collects face scan data from users who consent within the app, retaining it under the same 10-year post-relationship retention schedule stated elsewhere in the policy. The agreement does not specify a standalone mechanism for users to withdraw biometric consent or request deletion of face scan data independently of a full account deletion request.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Venmo.