Webull collects biometric data such as facial recognition information to verify your identity when you open an account, using third-party verification services.
Your facial recognition and biometric data is collected by Webull and processed by third-party identity verification vendors during account opening, and this data is subject to heightened legal protections in several states that Webull must comply with.
Cross-platform context
See how other platforms handle Biometric and Identity Verification Data Collection and similar clauses.
Compare across platforms →Biometric data is uniquely sensitive — unlike a password or account number, your facial recognition data cannot be changed if compromised. Several states have enacted strict laws governing biometric data collection, including Illinois which allows private lawsuits.
REGULATORY FRAMEWORK: Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14) imposes strict requirements for collection and use of biometric identifiers including facial recognition data, including written consent, a published retention and destruction policy, and a private right of action with statutory damages of $1,000-$5,000 per violation. Texas Biometric Privacy Law (CUBI, Tex. Bus. & Com. Code Ch. 503) and Washington's biometric law impose similar restrictions. CPRA classifies biometric data as 'sensitive personal information' subject to heightened use restrictions. GDPR Art. 9 classifies biometric data processed for identification as a special category requiring explicit consent and a specific Art. 9(2) exemption. FinCEN and KYC regulations under 31 CFR Part 1023 provide the legal basis for collection but do not preempt state biometric laws.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.