Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that third-party advertising partners are permitted to deploy tracking technologies on Figma's services to collect IP addresses, cookie identifiers, page visit data, location, and time-of-day data for use in interest-based advertising on third-party services.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes third-party advertising partners to independently collect identifiable behavioral data from Figma users across the service, and that data is then used for cross-site targeted advertising, engaging CCPA sale and sharing provisions and GDPR consent requirements for EU users.
The updated terms now restrict how Figma may use personal information from children. Children may only use the Services through a Figma for Education Enterprise agreement with their school, and Figma explicitly prohibits using children's personal information to train or improve AI services, serve targeted advertisements, or enable third-party tracking. Parents may contact Figma if they learn a child provided personal information without consent outside of an education agreement.
View change record →Under this provision, third-party advertising partners may collect a user's IP address, cookie identifiers, pages visited, inferred location, and time-of-day data through Figma's services, and use that data to serve targeted advertisements on other websites and services. Users can opt out through the 'Manage Cookies' tool in the Figma website footer or through industry opt-out platforms listed in the policy.
Cross-platform context
See how other platforms handle Advertising Partner Data Collection via Tracking Technologies and similar clauses.
Compare across platforms →Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Through our Services, we allow third-party advertising partners to set Technologies and other tracking tools to collect information regarding your activities and your device (e.g., your IP address, cookie identifiers, page(s) visited, location, time of day). These advertising partners use this information (and similar information collected from other websites) for purposes of delivering targeted advertisements to you when you visit third-party services within their networks. This practice is commonly referred to as "interest-based advertising" or "personalized advertising."Excerpt from Figma's Privacy Policy (Superseded URL)
1. REGULATORY LANDSCAPE: This provision directly engages CCPA sale and sharing provisions, as the transfer of behavioral data to advertising partners for cross-context behavioral advertising may qualify as a sale or sharing of personal information under CCPA. GDPR Article 6 consent requirements apply to EU users for non-essential advertising cookies. The FTC's framework for unfair or deceptive practices applies to the adequacy of disclosure and opt-out mechanisms. The Digital Services Act may also be relevant for EU users regarding targeted advertising. 2. GOVERNANCE EXPOSURE: Medium. The policy provides opt-out mechanisms through cookie management and industry self-regulatory platforms but does not specify the number or identity of advertising partners, making it difficult for users or compliance teams to assess the full scope of data sharing. CCPA compliance requires that the 'Manage Cookies' opt-out mechanism be functional and auditable. 3. JURISDICTION FLAGS: California users have CCPA-based rights to opt out of the sale or sharing of personal information, and the policy acknowledges this through its GPC signal recognition and Manage Cookies mechanism. EU users require affirmative consent before non-essential advertising cookies are set, which the policy addresses through the cookie consent tool. Users in other U.S. states with comprehensive privacy laws may have similar opt-out rights. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers deploying Figma in regulated sectors should assess whether employee behavioral data is being shared with advertising partners through platform usage, particularly if employees use Figma on organizational devices or networks. DPAs should address whether advertising partner data flows constitute processing on behalf of the customer or independent controller activity by Figma. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the functionality of the Manage Cookies opt-out mechanism to confirm it correctly suppresses advertising partner tracking. Organizations subject to CCPA as covered businesses should assess whether their deployment of Figma as a workspace tool creates obligations regarding employee personal information shared with advertising partners. Cookie consent records should be maintained for EU user sessions.
This provision authorizes third-party advertising partners to independently collect identifiable behavioral data from Figma users across the service, and that data is then used for cross-site targeted advertising, engaging CCPA sale and sharing provisions and GDPR consent requirements for EU users.
Under this provision, third-party advertising partners may collect a user's IP address, cookie identifiers, pages visited, inferred location, and time-of-day data through Figma's services, and use that data to serve targeted advertisements on other websites and services. Users can opt out through the 'Manage Cookies' tool in the Figma website footer or through industry opt-out platforms listed in the policy.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.