Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Figma recognizes GPC signals from supported browsers and treats them as CCPA opt-out requests for sale and sharing of personal information for targeted advertising, when the signal can be associated with an identifiable consumer. DNT signals are not recognized.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes CCPA's GPC signal recognition requirement, establishing that GPC-enabled browsers trigger an opt-out of sale and sharing for targeted advertising, while also providing a manual opt-out mechanism through the Manage Cookies footer link. The policy's qualification that recognition depends on the ability to associate the signal with an identifiable consumer introduces a practical limitation on GPC effectiveness.
The updated terms now restrict how Figma may use personal information from children. Children may only use the Services through a Figma for Education Enterprise agreement with their school, and Figma explicitly prohibits using children's personal information to train or improve AI services, serve targeted advertisements, or enable third-party tracking. Parents may contact Figma if they learn a child provided personal information without consent outside of an education agreement.
View change record →Under this provision, California users who enable a GPC signal in a supported browser will have that signal treated as a CCPA opt-out from the sale or sharing of their personal information for targeted advertising, subject to Figma's ability to associate the signal with their identity. An alternative manual opt-out is available through the 'Manage Cookies' link in the figma.com footer.
Cross-platform context
See how other platforms handle GPC Signal Recognition and CCPA Opt-Out and similar clauses.
Compare across platforms →Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Do Not Track ("DNT") and Global Privacy Consent ("GPC") signals are a privacy preferences that users can set in certain web browsers. We do not respond to DNT signals; however, we do recognize and process GPC signals by certain web browsers. If we are able to reasonably associate a GPC signal with an identifiable consumer, we will treat it as a request to opt-out of the "sale" or "sharing"/processing for targeted advertising of that consumer's personal information (as such terms are defined by the California Consumer Privacy Act). You can also opt out of the "sale" or "sharing" of your personal information by clicking on the "Manage Cookies" link in the footer of figma.com.Excerpt from Figma's Privacy Policy (Superseded URL)
1. REGULATORY LANDSCAPE: This provision directly engages CCPA as amended by CPRA, which requires covered businesses to recognize GPC signals as valid opt-out requests for sale and sharing of personal information. The California Privacy Protection Agency (CPPA) and California AG have enforcement jurisdiction. The policy's recognition of GPC for targeted advertising but not for other processing purposes reflects the statutory scope of the GPC requirement under CPRA. 2. GOVERNANCE EXPOSURE: Low to Medium. The policy's qualification that GPC recognition depends on the ability to associate the signal with an identifiable consumer is operationally significant: unauthenticated browsing sessions may not trigger the opt-out, which is a recognized technical limitation but should be documented in CCPA compliance records. The CPPA has issued guidance on GPC recognition requirements that should be reviewed against Figma's implementation. 3. JURISDICTION FLAGS: California users have the primary exposure under CCPA. Colorado's CPA also includes GPC recognition requirements, and the policy's reference to other U.S. states with comprehensive privacy laws may extend this obligation. Non-California users who enable GPC may not receive the same opt-out treatment unless they can be identified as California consumers. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers subject to CCPA as covered businesses that deploy Figma should confirm whether Figma's GPC implementation satisfies their own CCPA service provider or contractor obligations. The interaction between Figma's GPC mechanism and advertising partner tracking technologies should be technically audited to confirm opt-out effectiveness. 5. COMPLIANCE CONSIDERATIONS: Privacy teams should document Figma's GPC recognition mechanism and test its effectiveness across authenticated and unauthenticated browsing sessions. The distinction between GPC recognition (automatic) and the manual Manage Cookies opt-out (user-initiated) should be reflected in CCPA compliance records. The policy's silence on DNT signals should be noted in privacy program documentation.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision operationalizes CCPA's GPC signal recognition requirement, establishing that GPC-enabled browsers trigger an opt-out of sale and sharing for targeted advertising, while also providing a manual opt-out mechanism through the Manage Cookies footer link. The policy's qualification that recognition depends on the ability to associate the signal with an identifiable consumer introduces a practical limitation on GPC effectiveness.
Under this provision, California users who enable a GPC signal in a supported browser will have that signal treated as a CCPA opt-out from the sale or sharing of their personal information for targeted advertising, subject to Figma's ability to associate the signal with their identity. An alternative manual opt-out is available through the 'Manage Cookies' link in the figma.com …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.