X's New Privacy Policy Allows It To Collect Users' Biometric Data

Starting next month, X's updated privacy policy will entitle it to collect some users' biometric data and other personal information.

Under the revised policy, which takes effect September 29, X (formerly known as Twitter) "may collect and use your biometric information for safety, security and identification purposes" so long as the user provides consent.

The biometric data collection is for X Premium users only, the company told CBS MoneyWatch when reached for further information. 

"X will give the option to provide their Government ID, combined with a selfie, to add a verification layer. Biometric data may be extracted from both the Gov ID and the selfie image for matching purposes," the company said. "This will additionally help us tie, for those that choose, an account to a real person by processing their Government issued ID. This is to also help X fight impersonation attempts and make the platform more secure."

The microblogging platform does not define "biometric" in its policy, but the term generally refers to automated technologies — including facial recognition software, fingerprint taking, and palm and iris scanning — used for authenticating and verifying unique human body characteristics.

"The announcement is at least an acknowledgement that X will be doing what other social networks have already been doing in a more covert fashion," said Stephen Wicker, a professor at Cornell University and expert on data privacy,

X's move to collect biometric data comes after the website earlier this year introduced a subscription verification model that requires users to submit their government-approved identification to receive a blue checkmark on their accounts. The move is meant to curb bots and other fake accounts on the website, according to X. 

The company also plans to gather information on users' jobs and education histories, the updated policy shows. 

"We may collect and use your personal information (such as your employment history, educational history, employment preferences, skills and abilities, job search activity and engagement, and so on) to recommend potential jobs for you, to share with potential employers when you apply for a job, to enable employers to find potential candidates, and to show you more relevant advertising," the policy states.

X did not say whether the policy would also eventually apply to nonpaying X users or include other forms of data beyond that which can be gathered from government IDs. Its privacy policy also does not specify which users can opt into, or out of, biometric data gathering.

Some users have previously challenged X's data collection methods. A lawsuit, filed in July alleges that X has not "adequately informed individuals who have interacted (knowingly or not) with [its platform], that it collects and/or stores their biometric identifiers in every photograph containing a face that is uploaded to [the website]."

In 2021, Facebook agreed to a $650 million settlement of a privacy lawsuit for allegedly using photo face-tagging and other biometric data without users' consent.

"X's announcement is an expansion of the ongoing farming of social network users for personal data that can be used for directed advertising," Wicker said, adding that such data collection "continues to be a problem for the individuals that provide the data, while a source of wealth for those that take it."

The Associated Press contributed to this report.