California residents have specific legal rights under CCPA, including the right to know what data Figma has about them, delete it, correct it, and opt out of Figma sharing their information with advertising partners.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
California's CCPA and CPRA give residents enforceable rights over their data that go beyond what most other US users have, including the right to stop Figma from sharing personal data with advertising partners for cross-context behavioral advertising.
California residents can opt out of data sharing with advertising partners and request access to or deletion of their personal information by submitting a request through Figma's Privacy Request Portal or by emailing privacy@figma.com. Exercising these rights is free and Figma cannot discriminate against you for doing so.
How other platforms handle this
If you are a California resident, you have the right to: Know what personal information is being collected about you; Know whether your personal information is sold or disclosed and to whom; Say no to the sale of personal information; Access your personal information; Request deletion of your person...
If you are a California resident, you have the right to know what personal information we collect, use, and disclose about you; the right to request deletion of your personal information; the right to opt out of the sale or sharing of your personal information; the right to correct inaccurate person...
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell or share about you, the right to delete personal information we have collected from you, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of your personal information, and the right to non-discrimination for exercising your privacy rights. To submit a request, please visit our Privacy Request Portal or email us at privacy@figma.com.— Excerpt from Figma's Figma Privacy Policy
REGULATORY LANDSCAPE: This provision engages the California Consumer Privacy Act as amended by the California Privacy Rights Act, with enforcement authority held by the California Privacy Protection Agency and the California Attorney General. The CPRA introduced the right to correct inaccurate personal information and the right to limit use of sensitive personal information, both of which are referenced in this provision. Figma's characterization of advertising partner sharing as subject to the Do Not Sell or Share right reflects the CPRA's expansion of CCPA to cover sharing for cross-context behavioral advertising, not only outright sale. GOVERNANCE EXPOSURE: Medium. The policy asserts operational CCPA/CPRA compliance including a Privacy Request Portal, but compliance teams should verify that the portal functions correctly, that response timelines meet the 45-day statutory requirement, and that the Do Not Sell or Share opt-out is implemented across all relevant data flows including third-party advertising integrations. JURISDICTION FLAGS: This provision applies specifically to California residents. Other US states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, and Texas, have enacted similar but not identical rights frameworks. Figma's policy addresses California specifically but may need to be evaluated for compliance with these other state frameworks as well. CONTRACT AND VENDOR IMPLICATIONS: California-based enterprise customers should confirm whether Figma's data processing agreements reflect CPRA service provider restrictions, including prohibitions on using customer personal information for Figma's own business purposes outside the service relationship. The Do Not Sell or Share opt-out should be operationally verified for all California users in the organization. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the Privacy Request Portal for functionality and response time compliance. Internal escalation procedures for California privacy rights requests should be documented. Organizations with California employees who use Figma should consider whether employee personal data processed through Figma is subject to CPRA's employee privacy requirements.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
California's CCPA and CPRA give residents enforceable rights over their data that go beyond what most other US users have, including the right to stop Figma from sharing personal data with advertising partners for cross-context behavioral advertising.
California residents can opt out of data sharing with advertising partners and request access to or deletion of their personal information by submitting a request through Figma's Privacy Request Portal or by emailing privacy@figma.com. Exercising these rights is free and Figma cannot discriminate against you for doing so.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.