Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Figma certifies compliance with the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF, and commits to resolve DPF-related complaints within 45 days, with unresolved complaints referred to JAMS at no cost to the complainant.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a defined complaint and dispute resolution pathway for EU, UK, and Swiss residents regarding personal data handling, with the DPF Principles taking precedence over conflicting policy terms and binding arbitration available as a final recourse under the DPF framework.
The updated terms establish specific restrictions on how Figma may use personal information collected from minors. Children under 13 in the US, under 16 in California and the EU, and under 18 in Japan may now use the Services only through agreements with educational institutions. Figma states it will not use children's personal information to train, fine-tune, or improve AI services, nor will it permit service providers to do so. The policy also prohibits using children's data for marketing purposes, targeted advertising, or enabling third-party tracking. If a parent learns their child provided personal information without consent outside an educational agreement, they may contact Figma to report the issue.
View change record →Under this clause, EU, UK, and Swiss residents may submit complaints about Figma's personal data handling practices directly to Figma, with a 45-day resolution commitment, and may escalate unresolved complaints to JAMS at no charge. The agreement states that DPF Principles govern in the event of any conflict with the privacy policy terms.
Cross-platform context
See how other platforms handle EU-U.S. Data Privacy Framework Certification and Dispute Resolution and similar clauses.
Compare across platforms →Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Figma, Inc. (for the purposes of this section, "Figma", "we", or "us") complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Figma has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the DPF Principles, the DPF Principles shall govern. We commit to resolve DPF-related complaints about our collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of personal information received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact us using the contact details provided below. We will investigate and attempt to resolve any DPF-related complaints or disputes within forty-five (45) days of receipt. If you have an unresolved DPF complaint that we have not addressed satisfactorily, we have further committed to refer unresolved complaints to JAMS Data Privacy Dispute Resolution Program, an independent dispute resolution provider located in the U.S. made available free of charge.Excerpt from Figma's Privacy Policy
1. REGULATORY LANDSCAPE: The EU-U.S. DPF is administered by the U.S. Department of Commerce and enforced by the FTC, which is explicitly identified in the policy as having jurisdiction over Figma's DPF compliance. The DPF replaced the invalidated EU-U.S. Privacy Shield framework and is subject to periodic review by the European Commission. The DPF Principles establish obligations regarding notice, choice, accountability for onward transfer, security, data integrity, access, and recourse. Any failure to adhere to certified DPF commitments may expose Figma to FTC enforcement action. 2. GOVERNANCE EXPOSURE: Medium. The DPF certification creates enforceable obligations that the FTC may act upon if Figma's practices are found inconsistent with its certified commitments. The provision that DPF Principles govern over conflicting policy language is a material governance consideration, as it means users may have rights under the DPF that are not fully articulated in the policy text. Organizations relying on DPF as a transfer mechanism should monitor European Commission adequacy reviews, as prior adequacy decisions have been invalidated by the Court of Justice of the European Union. 3. JURISDICTION FLAGS: EU, UK, and Swiss residents are the primary beneficiaries of this provision. The DPF currently applies only to US-based certified organizations receiving data from those jurisdictions. Organizations in other regions do not benefit from DPF protections and must rely on SCCs or other transfer mechanisms. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers contracting with Figma and relying on DPF as a transfer mechanism should document Figma's DPF certification status (verifiable at dataprivacyframework.gov) and monitor for any changes or withdrawals of certification. The accountability for onward transfer principle under DPF means Figma remains liable for sub-processor data handling unless it can demonstrate non-responsibility for damages. 5. COMPLIANCE CONSIDERATIONS: Legal teams should verify Figma's current DPF certification status at dataprivacyframework.gov as part of vendor due diligence and maintain records of that verification. Organizations that experienced prior Privacy Shield reliance issues should assess whether DPF provides equivalent transfer security for their compliance programs. The 45-day complaint resolution timeline and JAMS escalation pathway should be communicated to relevant data protection officers.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a defined complaint and dispute resolution pathway for EU, UK, and Swiss residents regarding personal data handling, with the DPF Principles taking precedence over conflicting policy terms and binding arbitration available as a final recourse under the DPF framework.
Under this clause, EU, UK, and Swiss residents may submit complaints about Figma's personal data handling practices directly to Figma, with a 45-day resolution commitment, and may escalate unresolved complaints to JAMS at no charge. The agreement states that DPF Principles govern in the event of any conflict with the privacy policy terms.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.