Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that when a user interacts with or views a file, their IP address, specific in-file actions, and viewing timestamps may be disclosed to the file's administrator and, in some cases, to other file viewers.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that file administrators operating within enterprise or team deployments receive access to identifiable interaction data including IP addresses and specific user actions, which may create secondary data controller obligations for organizational customers subject to GDPR or CCPA.
The updated terms now restrict how Figma may use personal information from children. Children may only use the Services through a Figma for Education Enterprise agreement with their school, and Figma explicitly prohibits using children's personal information to train or improve AI services, serve targeted advertisements, or enable third-party tracking. Parents may contact Figma if they learn a child provided personal information without consent outside of an education agreement.
View change record →Under this provision, users who interact with or view Figma files may have their IP address, action history, and viewing timestamps disclosed to the file administrator and potentially to other viewers, regardless of whether the user is aware of this disclosure mechanism.
Cross-platform context
See how other platforms handle File Administrator Access to Viewer Activity Data and similar clauses.
Compare across platforms →Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When you interact with a user's file, information about your interaction, including your IP address and the actions you've taken in connection with the file, may be made available to the file's administrator. When you view a file, the fact that you viewed the file and when you viewed the file may be available to other viewers of the file.Excerpt from Figma's Privacy Policy (Superseded URL)
1. REGULATORY LANDSCAPE: This provision implicates GDPR transparency and data minimization principles, as the disclosure of IP addresses and behavioral data to file administrators represents a data sharing practice that data subjects may not anticipate. CCPA notice requirements are also engaged, as IP addresses qualify as personal information under CCPA. The FTC's framework for unfair or deceptive practices is relevant to the adequacy of notice provided to users about this disclosure. 2. GOVERNANCE EXPOSURE: Medium. Enterprise customers who receive file administrator data including IP addresses and user action logs may themselves become data controllers under GDPR with respect to that disclosed data, creating independent compliance obligations. This is particularly significant for large organizations using Figma for external client collaboration where the interacting users are not employees of the administrator organization. 3. JURISDICTION FLAGS: EU and UK users have heightened exposure as IP address disclosure to third-party administrators may require a documented legal basis under GDPR. California users retain CCPA rights over their personal information including IP addresses. Organizations in regulated sectors such as financial services or healthcare that use Figma for collaboration should assess whether this disclosure mechanism is consistent with their own data handling obligations. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should review whether their Figma service agreements and DPAs address the data controller status for administrator-accessible interaction data. B2B contracts involving Figma collaboration with external parties may need to include disclosure provisions about this data sharing mechanism. Procurement teams should assess whether this disclosure is consistent with their internal data governance policies. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether end users and external collaborators are provided adequate notice of this file-level activity disclosure, particularly in contexts where Figma is used to collaborate with clients or partners who are not employees. Data mapping exercises should capture the flow of interaction data to administrators as a distinct data sharing pathway.
This provision establishes that file administrators operating within enterprise or team deployments receive access to identifiable interaction data including IP addresses and specific user actions, which may create secondary data controller obligations for organizational customers subject to GDPR or CCPA.
Under this provision, users who interact with or view Figma files may have their IP address, action history, and viewing timestamps disclosed to the file administrator and potentially to other viewers, regardless of whether the user is aware of this disclosure mechanism.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.