Biometric Data Statement
Effective Date: October 2, 2026
This Statement explains how ID123 Inc. (“ID123”) handles facial photographs and face data in connection with the digital and physical identification credentials it provides to institutions. It is published to make a written retention and destruction policy publicly available, as required by the Illinois Biometric Information Privacy Act and similar laws, and it supplements the ID123 Privacy Policy.
1. What we process
1.1 Facial photographs. Institutions that issue credentials through ID123 upload, or ask the people they issue credentials to submit, a photograph for display on the credential. Photographs are processed on behalf of the issuing institution.
1.2 Face data. To check that a photograph meets the institution’s photo guidelines and, where the institution enables it, to compare a photograph captured in the mobile application with the photograph on the credential record, ID123 may derive face data from a photograph for the duration of that check. ID123 does not store face data processed from photographs on its servers, does not maintain a database of facial templates, and does not perform one-to-many facial identification.
2. Purposes
Face data is used only to (a) check a photograph against the institution’s photo guidelines, such as whether the subject’s eyes are open and the face is unobstructed, and (b) where enabled by the institution and permitted by the individual, confirm by one-to-one comparison that the person installing a credential is the person to whom it was issued. Face data is not used for any other purpose, is not sold, leased or traded, and is not used to train artificial intelligence or machine learning models.
3. Notice and consent
3.1 The issuing institution is responsible for informing the people it issues credentials to, and for obtaining any consent required by applicable law, before their photographs are collected and processed.
3.2 One-to-one comparison in the mobile application is performed only where it is enabled by the institution and permitted by the individual.
4. Retention and destruction
4.1 Face data. Face data is destroyed on completion of the check for which it was derived, and is not stored on ID123’s servers.
4.2 Photographs. Photographs are retained and deleted in accordance with the ID123 Data Retention & Deletion Schedule.
4.3 Outer limit. In any event, ID123 permanently destroys any biometric identifier or biometric information when the initial purpose for collecting it has been satisfied, or within three years of the individual’s last interaction with the issuing institution through ID123, whichever occurs first.
5. Disclosure
ID123 does not sell, lease, trade or otherwise disclose face data to third parties, other than sub-processors acting on its behalf as listed on the ID123 Sub-Processors page, or where required by law.
6. Security
Photographs are stored in private, encrypted object storage, encrypted at rest using AES-256 with keys managed through the cloud provider’s key management services, and are transmitted only over encrypted connections. Access is restricted on a least-privilege basis. ID123’s security program is described on the ID123 Security page.
7. Applicable law
This Statement is intended to support compliance with the Illinois Biometric Information Privacy Act (740 ILCS 14), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), Washington’s biometric identifier and consumer health data laws (RCW 19.375 and RCW 19.373), and, where they apply, the GDPR and UK GDPR, under which biometric data processed for the purpose of uniquely identifying a person is special category data.
8. Contact
Questions about this Statement can be sent to privacy@id123.io, or by post to ID123 Inc., 100 Summer Street, Suite 1600, Boston, MA 02110, United States.