Question 1

Does Expo Local Authentication require disclosure in our privacy policy?

Accepted Answer

Yes. Because Expo Local Authentication processes biometric data to authenticate users, it must be disclosed in your privacy policy under GDPR Article 9 (special category data) and CCPA requirements. You must explain how biometric authentication works, that results are processed, and users' rights regarding this data. Transparency is especially important for biometric processing.

Question 2

What specific data does Expo Local Authentication collect?

Accepted Answer

Expo Local Authentication collects only the biometric authentication result—whether the user's fingerprint or Face ID matched the device's stored biometric template. The actual biometric data (fingerprint patterns, facial geometry) never leaves the device and is not collected by Expo. Only the pass/fail authentication outcome is processed by your application.

Question 3

Does Expo Local Authentication require a cookie consent banner?

Accepted Answer

No. Expo Local Authentication does not use cookies. However, if your app stores authentication tokens or session data after successful biometric verification, those storage mechanisms may require disclosure. The biometric authentication process itself operates independently of cookie-based tracking and does not trigger cookie consent requirements.

Question 4

Who processes the data, and where is it transferred?

Accepted Answer

Expo (650 Industries, United States) provides the authentication framework, but biometric data processing occurs entirely on the user's device. Authentication results are transferred only to your application's backend systems—not to Expo's servers. You remain the data controller for authentication results, with Expo acting as a service provider for the authentication mechanism only.

Privacy policy clauses for Expo Local Authentication

What data Expo Local Authentication collects

Where data goes

Legal note

Sample privacy policy clause

Frequently asked questions

Does Expo Local Authentication require disclosure in our privacy policy?

What specific data does Expo Local Authentication collect?

Does Expo Local Authentication require a cookie consent banner?

Who processes the data, and where is it transferred?

Don't ship without Bandit.