Adobe Privacy Policy

This document is Adobe's global Privacy Policy (last updated October 24, 2025), governing the collection, use, and disclosure of personal information across Adobe's websites, software, and cloud-based services, with legal basis varying by jurisdiction: California and U.S. law apply to North American users, Irish law to users outside North America and Japan, and Japanese law to Japan-based users. The policy states that Adobe collects a broad range of data including identifiers, biometric identifiers (faceprints, voiceprints), precise geolocation, browser and device telemetry, user-generated content and prompts, inferred demographic data from third-party brokers, and content stored on Adobe servers, and the terms authorize use of this data for service delivery, product improvement, fraud prevention, content analytics, marketing, and sharing with advertising partners, resellers, and data brokers under a legitimate interests basis where consent is not required by law. The policy asserts a legitimate interests basis for sharing user information with third-party advertising partners and for analyzing cloud-stored content using automated techniques and human review, which may engage tension with GDPR Article 6 balancing requirements and CCPA opt-out rights for data sales or sharing; the policy also discloses that account information registered under a business email address may be shared with employers for account migration purposes, which creates a distinct and potentially unexpected disclosure risk for individual employees. The policy engages GDPR, CCPA and California Privacy Rights Act (CPRA), and references location-specific notices for additional jurisdictional rights; biometric data collection practices may additionally require evaluation under the Illinois Biometric Information Privacy Act (BIPA) and similar state laws. Material compliance considerations include the adequacy of consent mechanisms for biometric data processing, the sufficiency of opt-out mechanisms for content analytics and marketing data sharing, and the scope of data transfers across national borders under applicable transfer frameworks such as the EU-U.S. Data Privacy Framework.