This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The updated policy restricts children's use of Figma to educational contexts only, requiring an agreement between the child's school and Figma. The revised terms explicitly state that Figma does not use children's personal information to train, fine-tune, or develop AI services, does not use it for marketing or targeted advertising, and prohibits third-party advertising partners from collecting children's data through the Services. Parents who discover their child provided personal information outside a school agreement may contact Figma at privacy@figma.com.
View change record →How other platforms handle this
When we receive personal data under the DPF and then transfer it to a third-party service provider acting as our agent on our behalf, we may have certain responsibility under the DPF if both (a) the agent processes the information in a manner inconsistent with the DPF and (b) we are responsible for ...
Indemnifying Party will not settle any Claim for which it has an obligation to indemnify under this Section 6 admitting liability or fault on behalf of Indemnified Party, nor create any obligation on behalf of Indemnified Party without Indemnified Party's prior written consent...
You are responsible for any damages suffered by PayPal or any third parties resulting from your failure to follow the rules of the PayPal Advertising Program...
"If we have received your personal information in the U.S. and subsequently transfer that information to a third party acting as an agent, and such third party agent processes your personal information in a manner inconsistent with the DPF Principles, we will remain liable...Excerpt from Figma's Privacy Policy (Superseded URL)
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The clause states: “If we have received your personal information in the U.S. and subsequently transfer that information to a third party acting as an agent, and such third party agent processes your personal information in a manner inconsistent with the DPF Principles, we will remain liable...”
ConductAtlas has identified this type of provision across 228 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.