The policy states that personal information is transferred to and stored in the United States and other countries where Figma's affiliates and sub-processors operate, with transfers from the EEA, Switzerland, and UK relying on Standard Contractual Clauses (Module 2, June 2021) and the UK Addendum as transfer mechanisms.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal transfer mechanisms Figma relies on for cross-border personal data flows from the EU, UK, and Switzerland to the US and other jurisdictions, and discloses that transferred data may be subject to government access requests in destination jurisdictions.
The updated terms establish specific restrictions on how Figma may use personal information collected from minors. Children under 13 in the US, under 16 in California and the EU, and under 18 in Japan may now use the Services only through agreements with educational institutions. Figma states it will not use children's personal information to train, fine-tune, or improve AI services, nor will it permit service providers to do so. The policy also prohibits using children's data for marketing purposes, targeted advertising, or enabling third-party tracking. If a parent learns their child provided personal information without consent outside an educational agreement, they may contact Figma to report the issue.
View change record →Under this clause, personal information collected from EU, UK, and Swiss users is transferred to and stored in the United States, with Standard Contractual Clauses serving as the primary legal transfer mechanism for non-adequacy-decision jurisdictions. The policy acknowledges that destination jurisdictions may have data protection laws that are less protective than the laws in the user's home country, and that data may be subject to government access requests in those jurisdictions.
Cross-platform context
See how other platforms handle International Data Transfers and Standard Contractual Clauses and similar clauses.
Compare across platforms →"Where we transfer your personal information to countries and territories outside of the European Economic Area ("EEA"), Switzerland and the UK which have been formally recognized as providing an adequate level of protection for personal information, we rely on the relevant "adequacy decisions" and "adequacy regulations" from the European Commission, Swiss and UK authorities. Where the transfer is not subject to an adequacy decision or derogation under the applicable law, we take appropriate safeguards to ensure that your personal information will remain protected in accordance with this Privacy Policy and applicable laws. These safeguards include implementing the Module 2 of European Commission's Standard Contractual Clauses as issued on 4 June 2021 under Article 46(2) GDPR for transfers originating in the EEA, Switzerland (with amendments required under the applicable Swiss law) and the UK Addendum permitted under Article 46(2) of the UK GDPR for the transfer of data originating in the UK.Excerpt from Figma's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the legal transfer mechanisms Figma relies on for cross-border personal data flows from the EU, UK, and Switzerland to the US and other jurisdictions, and discloses that transferred data may be subject to government access requests in destination jurisdictions.
Under this clause, personal information collected from EU, UK, and Swiss users is transferred to and stored in the United States, with Standard Contractual Clauses serving as the primary legal transfer mechanism for non-adequacy-decision jurisdictions. The policy acknowledges that destination jurisdictions may have data protection laws that are less protective than the laws in the user's home country, and that …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.