Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that Google may collect biometric information including fingerprints in product development studies, and health information including medical history, vital signs, blood glucose levels, and physical and mental health data through services including Google Health Studies, Fitbit, and Pixel devices, when users choose to provide it.
This analysis describes what YouTube Ads's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses collection of biometric and health data categories that are subject to heightened regulatory requirements under multiple state statutes, including the Illinois Biometric Information Privacy Act for biometric data and the Washington My Health My Data Act for health data; the voluntary provision framing does not eliminate compliance obligations associated with collecting these sensitive categories.
The updated policy makes several material clarifications about how Google links your activity across websites and apps. It shifts from describing analytics tools in isolation to framing them as part of a broader 'ad and analytics services' ecosystem, and broadens the scope of data linking to explicitly include 'cookies and other technologies'. The policy also clarifies that data sharing occurs even in private browsing modes. Review your Google Account activity controls to understand what data is being collected and linked across services you use.
View change record →⚠ Biometric and health data provided through Google services will be processed as described in the policy until withdrawn or deleted by the user
Cross-platform context
See how other platforms handle Biometric and Sensitive Category Data Collection and similar clauses.
Compare across platforms →Monitoring
YouTube Ads has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Biometric information if you choose to provide it, such as fingerprints in Google's product development studies. Health information if you choose to provide it, such as your medical history, vital signs and health metrics (like blood glucose levels), and other similar information related to your physical or mental health, in the course of using Google services that offer health-related features, such as the Google Health Studies app, Fitbit, or Pixel devices.Excerpt from YouTube Ads's Google Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates the Illinois Biometric Information Privacy Act for biometric data collection, which requires written consent and imposes specific retention, destruction, and prohibition on sale or profit obligations. The Washington My Health My Data Act and Nevada SB 370 apply to health information as separately addressed in the policy. GDPR Article 9 classifies health data and biometric data as special categories requiring explicit consent and additional safeguards. The FTC has enforcement authority over deceptive or unfair sensitive data collection practices. 2. GOVERNANCE EXPOSURE: High for organizations or Google itself operating in Illinois, Washington, and other jurisdictions with biometric or health data specific statutes. Illinois BIPA provides a private right of action with statutory damages, creating significant litigation exposure for biometric data collection practices. The breadth of health data collected through Fitbit and Pixel devices, including sleep patterns, heart rate, and blood glucose levels, creates compliance surface area across multiple state health privacy frameworks. 3. JURISDICTION FLAGS: Illinois creates the highest exposure for biometric data under BIPA, which has been the subject of extensive class action litigation. Washington and Nevada create heightened health data exposure as described separately. Texas has enacted a biometric privacy statute. EU and EEA jurisdictions require explicit consent for special category data under GDPR Article 9. California CPRA treats biometric and health information as sensitive personal information subject to enhanced rights and opt-out requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Google services that involve biometric or health data processing should review whether their own data processing agreements with Google adequately address BIPA consent obligations, health data consent and withdrawal mechanisms, and GDPR Article 9 safeguards. Product development study participants should evaluate the specific consent terms applicable to biometric data collection in those studies. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that biometric data collection in product development studies is accompanied by BIPA-compliant written consent, retention schedules, and destruction procedures where applicable. Health data collection through Fitbit, Pixel, and Google Health Studies should be mapped against Washington My Health My Data Act and Nevada SB 370 consent requirements. GDPR special category processing records should document the explicit consent basis for health and biometric data processing for EU and EEA users.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision discloses collection of biometric and health data categories that are subject to heightened regulatory requirements under multiple state statutes, including the Illinois Biometric Information Privacy Act for biometric data and the Washington My Health My Data Act for health data; the voluntary provision framing does not eliminate compliance obligations associated with collecting these sensitive categories.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by YouTube Ads.