Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal information is retained for the duration of service use or as necessary for listed business and legal purposes, and that requesting deletion of personal information requires the user to delete their Figma account entirely.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision conditions personal data deletion on full account deletion, meaning users cannot request removal of specific personal data categories while retaining their Figma account, which may interact with GDPR and CCPA data minimization and deletion rights depending on the specific data category and processing purpose involved.
Interpretive note: The policy does not specify which data categories are indispensable to account maintenance versus which could be deleted without full account closure, creating ambiguity about the proportionality of the account-deletion precondition under GDPR and CCPA.
The updated terms now restrict how Figma may use personal information from children. Children may only use the Services through a Figma for Education Enterprise agreement with their school, and Figma explicitly prohibits using children's personal information to train or improve AI services, serve targeted advertisements, or enable third-party tracking. Parents may contact Figma if they learn a child provided personal information without consent outside of an education agreement.
View change record →Under this provision, a user who requests deletion of their personal information must also delete their Figma account, as the policy states that personal information is necessary to maintain the account. Certain data may be retained even after a deletion request to comply with legal requirements.
Cross-platform context
See how other platforms handle Data Retention and Deletion upon Account Closure and similar clauses.
Compare across platforms →Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We store the personal information we receive as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and/or comply with applicable laws... You may request deletion of your personal information at any time as noted in "Your Privacy Rights", above, but that will require you to delete your account with us, as we need your personal information to maintain your account.Excerpt from Figma's Privacy Policy (Superseded URL)
1. REGULATORY LANDSCAPE: This provision engages GDPR Article 17 (right to erasure) and CCPA deletion rights. GDPR recognizes exceptions to erasure for legal obligation compliance, establishment of legal claims, and certain legitimate interests, which the policy references. However, the policy's coupling of data deletion with mandatory account deletion may face scrutiny under GDPR's proportionality and data minimization principles, particularly for data categories not essential to account maintenance. The FTC and state attorneys general have jurisdiction over CCPA deletion right compliance. 2. GOVERNANCE EXPOSURE: Medium. The account-deletion requirement as a precondition to personal data deletion is a structural design choice that may limit the practical exercisability of deletion rights for active users. GDPR enforcement authorities in the EU have addressed similar design constraints in other contexts, though specific outcomes depend on the data categories and purposes involved. 3. JURISDICTION FLAGS: EU and UK users have heightened exposure as GDPR's right to erasure has well-developed regulatory guidance. California users retain CCPA deletion rights and may challenge overly broad retention justifications. Other U.S. states with comprehensive privacy laws that include deletion rights may have similar considerations. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should assess whether the account-linked retention model is consistent with their own data retention obligations and employee or client data deletion policies. DPAs should specify how deletion requests from data subjects are handled in the enterprise context and whether the account-deletion precondition applies to all user types. 5. COMPLIANCE CONSIDERATIONS: Compliance teams processing data subject deletion requests should document how the account-deletion requirement is communicated to requestors and whether exceptions apply for specific data categories. The policy's reference to backup archive retention should be evaluated to ensure that isolated backup data is subject to appropriate access controls and deletion timelines.
This provision conditions personal data deletion on full account deletion, meaning users cannot request removal of specific personal data categories while retaining their Figma account, which may interact with GDPR and CCPA data minimization and deletion rights depending on the specific data category and processing purpose involved.
Under this provision, a user who requests deletion of their personal information must also delete their Figma account, as the policy states that personal information is necessary to maintain the account. Certain data may be retained even after a deletion request to comply with legal requirements.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.