Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Customer Content may be used to train Figma's AI models when the 'Content Training' setting is enabled by an administrator, with de-identification and aggregation steps applied to the data used for training.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that the use of Customer Content for AI model training is governed by an administrative setting, meaning the decision rests with organizational administrators rather than individual end users in enterprise contexts. The policy does not disclose the default state of this toggle in its text, which is a material operational detail for compliance teams assessing data processing scope.
Interpretive note: The policy does not disclose the default state of the Content Training toggle, and the scope of de-identification measures applied to training data is not specified in the policy text.
The updated terms now restrict how Figma may use personal information from children. Children may only use the Services through a Figma for Education Enterprise agreement with their school, and Figma explicitly prohibits using children's personal information to train or improve AI services, serve targeted advertisements, or enable third-party tracking. Parents may contact Figma if they learn a child provided personal information without consent outside of an education agreement.
View change record →Under this provision, Customer Content including design materials and any voice data captured through Figma voice features may be used for AI training when the Content Training setting is active. Individual end users in organizational accounts may not control this setting directly, as it is described as an administrative user setting.
Cross-platform context
See how other platforms handle AI Content Training via Administrator Toggle and similar clauses.
Compare across platforms →Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Improving our Services through artificial intelligence. This includes: if "Content Training" is toggled on within your administrative user settings, Customer Content and where we act as a controller (e.g. when processing Usage Data). We take steps to de-identify and aggregate data to protect your privacy for data we use to train AI models.Excerpt from Figma's Privacy Policy (Superseded URL)
1. REGULATORY LANDSCAPE: This provision implicates GDPR Article 6 legitimate interests as the stated legal basis, and engages CCPA provisions regarding the use of personal information for purposes beyond the primary service delivery context. The EU AI Act may also be relevant to the extent Figma's AI models are classified under its risk categories, though the policy does not address this. The FTC holds enforcement jurisdiction over unfair or deceptive practices related to AI data use for U.S. users. 2. GOVERNANCE EXPOSURE: Medium. The provision asserts legitimate interests as the legal basis for AI training on Customer Content, but under GDPR, legitimate interests requires a documented balancing test weighing Figma's interests against data subjects' rights. The policy asserts this basis without disclosing the balancing outcome. Additionally, the policy does not specify the default state of the Content Training toggle, leaving enterprise compliance teams unable to determine their current processing exposure from the policy text alone. 3. JURISDICTION FLAGS: EU and UK users have heightened exposure given GDPR and UK GDPR requirements around legitimate interests documentation and data subject rights regarding automated processing. California users may have CCPA rights to opt out of uses of personal information beyond the original service context. Enterprise customers subject to their own GDPR or CCPA obligations should assess whether their use of Figma constitutes a processor or controller relationship with respect to this AI training data use. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers reviewing their Figma agreements should confirm whether the Data Processing Addendum addresses the AI training data use and what processor versus controller designations apply. Procurement teams should verify the default state of the Content Training toggle through direct product testing or written confirmation from Figma, as the policy text does not disclose this. Contracts with clients whose data is processed in Figma may need to be reviewed to ensure AI training disclosure obligations are satisfied. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the current Content Training toggle state for all organizational accounts and document the configuration decision. Data mapping exercises should capture whether Customer Content qualifies as personal data under applicable law and whether it flows into AI training pipelines. If the toggle is or was enabled, data subject rights requests related to AI training data use may require specific process design to address.
This provision establishes that the use of Customer Content for AI model training is governed by an administrative setting, meaning the decision rests with organizational administrators rather than individual end users in enterprise contexts. The policy does not disclose the default state of this toggle in its text, which is a material operational detail for compliance teams assessing data processing …
Under this provision, Customer Content including design materials and any voice data captured through Figma voice features may be used for AI training when the Content Training setting is active. Individual end users in organizational accounts may not control this setting directly, as it is described as an administrative user setting.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.