Binance is the world's largest cryptocurrency exchange, operated through a cluster of affiliated legal entities (including Binance Holdings Limited, Binance (Services) Holdings Limited, and Binance Holdings (IE) Limited, doing business as Binance and Binance.com) that a 2023 U.S. regulatory consent order describes as commonly owned and controlled by the same individual, with no single publicly disclosed corporate domicile. Its privacy notice discloses collection of biometric facial-scan data and government ID documents for KYC verification, broad device/technical identifiers, and sharing of personal data with marketing partners for targeting, modelling, and advertising. The iOS App Store privacy label (developer of record: Binance Switzerland AG) discloses that Identifiers and Usage Data may be used to track users across apps and websites owned by other companies. In November 2023, Binance and its founder resolved a $4.3 billion DOJ/FinCEN/OFAC action for Bank Secrecy Act, unlicensed money transmission, and sanctions violations — an anti-money-laundering and sanctions enforcement matter, not a privacy incident, so it is noted here but not treated as a privacy track-record floor. Separately, Binance's own August 2019 statement on reports of a KYC-photo leak stated that no evidence indicated the images came from Binance's systems (citing the absence of Binance's digital watermark), leaving no confirmed primary-sourced privacy breach on the record.
TRACK RECORD
1 ENFORCEMENT ACTION
[2023-11-21]
FinCEN's November 21, 2023 press release states its consent order assessed a $3.4 billion civil money penalty against Binance and imposed a five-year monitorship, part of a combined $4.3 billion DOJ/FinCEN/OFAC resolution for Bank Secrecy Act, unlicensed money-transmission, and sanctions violations. This is an anti-money-laundering and sanctions enforcement matter, not a privacy incident, and is noted for context without being scored as a privacy track-record floor.
Binance's privacy notice lists biometric information (facial-scan data compared against a government-issued ID photo) collected for KYC identity verification, alongside government-issued identity document numbers and online identifiers such as social media profiles, as categories of personal data it collects.
The Binance iOS App Store privacy label separately names 'Binance Switzerland AG' as the developer of record responsible for the app's privacy practices — a different named entity than those listed in the FinCEN consent order, illustrating the inconsistent, multi-entity corporate structure across primary sources.
FinCEN's November 2023 Consent Order in the matter of Binance Holdings Limited, et al. identifies three affiliated Binance legal entities (Binance Holdings Limited, Binance (Services) Holdings Limited, and Binance Holdings (IE) Limited) as commonly owned and controlled by the same individual, who is also the CEO of the Binance.com exchange business, without naming a single corporate headquarters jurisdiction.
Binance's privacy notice states it may share users' personal data with its marketing partners for targeting, modelling, and/or analytics as well as marketing and advertising, with the notice framing the primary user control as a general right to object rather than a categorical no-sale/no-share guarantee.
Binance's own August 2019 blog statement responding to reports of a leaked cache of KYC verification photos said no evidence had been supplied that the images came from Binance's systems, pointing to the absence of Binance's digital watermark on the circulated images, while acknowledging some images overlapped with a third-party vendor Binance had used.
FinCEN's November 21, 2023 press release states its consent order assessed a $3.4 billion civil money penalty against Binance and imposed a five-year monitorship, part of a combined $4.3 billion DOJ/FinCEN/OFAC resolution for Bank Secrecy Act, unlicensed money-transmission, and sanctions violations. This is an anti-money-laundering and sanctions enforcement matter, not a privacy incident, and is noted for context without being scored as a privacy track-record floor.
Binance's privacy notice discloses automatic collection of device and technical identifiers — device ID, IP address, browser type/version, device model, time zone, language, and app version — as part of its standard data-collection practices.
The Binance iOS App Store privacy label states that Identifiers and Usage Data may be used to track the user across apps and websites owned by other companies, confirming cross-app/cross-site tracking rather than first-party analytics only.