gemini.com privacy policy — score 52/100 (medium risk)
Dernière analyse
Le contenu du rapport (résumé, constats, citations) a été généré en anglais et n'est pas localisé.
Gemini · gemini.com
Détails du rapport
medium risqueGemini collects extensive personal and financial data as a regulated crypto exchange, shares it widely with third parties for marketing and analytics, and transfers it globally, though it provides standard GDPR rights and SCCs for EU users.
Gemini's privacy policy reflects its status as a heavily regulated financial institution, requiring vast amounts of sensitive personal and financial data for KYC/AML compliance. However, the policy also permits broad data sharing with marketing and advertising partners, extensive tracking (including keystrokes and session replays), and global data transfers. While EU users are provided with Standard Contractual Clauses and clear supervisory authority contacts, the policy contains ambiguous language regarding the universality of user rights and the use of data for AI training.
Évaluation par catégorie
Répartition de la politique selon les principaux domaines de conformité. Bon = solide, moyen = mitigé, faible = préoccupant.
Collects highly sensitive data like biometrics, keystrokes, and session replays alongside extensive financial and identification information.
The policy is detailed and structured, but the broad language around 'other business or commercial purposes' and discretionary rights creates ambiguity.
Data is shared with marketing, advertising, and analytics partners in addition to service providers, which is excessive for a financial platform.
SCCs and UK IDTA are used for EU/UK transfers, but data flows globally including to the US, with an exception carved out for emergency law enforcement transfers.
Explicitly states anonymized data is used for internal AI training and records inputs to AI tools, but lacks detail on anonymization standards or opt-out.
Provides standard GDPR rights and DPA contacts for EU/UK users, but makes rights discretionary for users in other jurisdictions.
Constats clés
Clauses notables, problèmes ou bonnes pratiques identifiées (critiques en premier)
Excessive Data Collection for Non-Essential Purposes
The policy collects a vast array of highly sensitive data beyond what is strictly necessary for a crypto exchange, including biometric information (face geometry), employment/institutional details, and session replay/keystroke data.
Broad Third-Party Sharing for Marketing
Personal information is shared broadly with marketing and advertising partners, analytics partners, and business partners, which is concerning for a financial institution handling sensitive data.
Ambiguous AI Training Practices
The policy explicitly states Gemini may use 'anonymized Personal Information to train AI models for internal use only' and records inputs to 'AI-supported tools', but lacks clarity on whether this data is truly irreversible anonymized or if users can opt out.
Discretionary User Rights
The policy states that if rights are not provided by law for the operating entity, 'Gemini may exercise its discretion in providing you with these rights,' creating uncertainty about the universality of data subject rights.
Vague Retention Periods
The policy states data is retained 'for as long as is reasonably necessary' or to comply with legal obligations, without specifying concrete retention periods for different categories of data.
Synthèse pour l'utilisateur
Gemini collects a massive amount of sensitive data, including biometrics and detailed tracking data, and shares it with marketing partners. While they offer standard EU privacy rights, users outside the EU may find their rights applied at Gemini's discretion.
Posture de conformité
mixed
Transferts UE
Data is transferred globally, including to the US. For EU/UK users, Gemini relies on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA)/Addendum. The policy also mentions using Article 49(1)(f) derogations for law enforcement in emergencies, which is a potential loophole.
Signaux détectés
Données et pratiques spécifiques identifiées dans le texte
Extraits probants
Citations directes de la politique à l'appui de ces constats
Biometric Information, such as scans of your face geometry extracted from identity documents
We may use anonymized Personal Information to train AI models for internal use only.
We rely primarily on the European Commission’s Standard Contractual Clauses to facilitate international transfers of Personal Information to third countries, including from Gemini’s European operations to Gemini Trust Company, LLC in the United States.
If any of the rights listed below are not provided by law for your operating entity or jurisdiction, Gemini may exercise its discretion in providing you with these rights.
Usage Data, such as system activity, internal and external information related to Gemini pages that you visit, clickstream information, keystrokes, mouse movements, form field entries, recordings of chat sessions or your use of and inputs to other AI-supported tools
Manquant ou flou
- No specific list of sub-processors or third-party partners is provided in the main policy.
- No clear retention periods specified, only that data is kept 'as long as is reasonably necessary' or to comply with legal obligations.
- No explicit opt-out mechanism for AI model training on user data, only a claim that it is anonymized.
- No detail on the specific legal bases used for marketing and advertising sharing beyond 'legitimate interests' or 'consent'.
- No information on Data Protection Impact Assessments (DPIAs) for high-risk processing like biometrics.
Questions à poser
- What specific third parties act as your marketing, advertising, and analytics partners, and where is the sub-processor list maintained?
- How is personal data anonymized before being used for internal AI model training, and is this process irreversible?
- What are the specific retention periods for different categories of personal data, particularly biometric and KYC data?
- Under what specific circumstances do you use Article 49(1)(f) derogations to transfer data to law enforcement outside the EEA, and how is necessity demonstrated?
- How do you ensure that session replay and keystroke data is minimized and not used for purposes beyond security and fraud prevention?
Partager cette analyse
Toute personne disposant de ce lien peut consulter le résultat ci-dessus.
Conçu par DentroChat
Chat IA 100 % européen pour tous
Discutez avec l'IA, travaillez avec des fichiers, générez des images et cherchez sur le web. Les données restent en Europe.