Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision authorizes X to collect and use biometric information from users, conditioned on user consent, for stated purposes of safety, security, and identification.
This analysis describes what X's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes X's authority to collect biometric data, a category subject to heightened legal requirements under multiple US state laws including Illinois BIPA, Washington's biometric privacy law, and Texas's CUBI statute, as well as GDPR's special category data provisions. The adequacy of the consent mechanism and the scope of permitted use are material compliance considerations.
Interpretive note: The policy does not specify which biometric modalities are collected, how consent is obtained or revoked, or the retention period for biometric data, creating uncertainty about compliance with state-specific biometric privacy statutes.
The agreement states that X may collect biometric information upon user consent for safety, security, and identification purposes; users in states with biometric privacy statutes (such as Illinois, Texas, and Washington) may have additional rights and protections under applicable state law beyond what this policy describes.
Cross-platform context
See how other platforms handle Biometric Information Collection and similar clauses.
Compare across platforms →Monitoring
X has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Based on your consent, we may collect and use your biometric information for safety, security, and identification purposes.Excerpt from X's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision directly engages the Illinois Biometric Information Privacy Act (BIPA), which requires written consent, a publicly available retention schedule, and prohibition on sale or profit from biometric data. Texas and Washington have analogous biometric privacy laws. At the federal level, the FTC has taken enforcement actions related to biometric data collection under its unfair or deceptive practices authority. GDPR Article 9 classifies biometric data as a special category of personal data requiring explicit consent and additional safeguards for EU/EEA users. (2) GOVERNANCE EXPOSURE: High. Biometric data collection carries heightened regulatory risk across multiple US state jurisdictions and under GDPR. The policy's disclosure is brief and does not specify the types of biometric identifiers collected, the retention period for biometric data, or the mechanism for consent withdrawal, which may be insufficient under BIPA and analogous statutes. (3) JURISDICTION FLAGS: Illinois creates the highest exposure given BIPA's private right of action, which allows individuals to sue for statutory damages without proving actual harm. Texas and Washington also impose biometric privacy obligations. EU/EEA users are protected by GDPR Article 9's explicit consent requirement for special category data. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise clients and B2B users operating in Illinois should assess whether employee or customer data processed through X's platform could trigger BIPA obligations. The policy does not disclose whether biometric data is shared with service providers or third parties, which would implicate additional BIPA compliance requirements. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether X's consent mechanism for biometric data meets BIPA's written consent standard and whether a publicly available biometric retention policy is maintained. Data mapping should specifically track biometric identifier categories. For EU/EEA processing, a DPIA is likely warranted given the special category status of biometric data under GDPR.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes X's authority to collect biometric data, a category subject to heightened legal requirements under multiple US state laws including Illinois BIPA, Washington's biometric privacy law, and Texas's CUBI statute, as well as GDPR's special category data provisions. The adequacy of the consent mechanism and the scope of permitted use are material compliance considerations.
The agreement states that X may collect biometric information upon user consent for safety, security, and identification purposes; users in states with biometric privacy statutes (such as Illinois, Texas, and Washington) may have additional rights and protections under applicable state law beyond what this policy describes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by X.