Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal information is transferred to and stored in the United States and other countries where Figma's affiliates and sub-processors operate, with transfers from the EEA, Switzerland, and UK relying on Standard Contractual Clauses (Module 2, June 2021) and the UK Addendum as transfer mechanisms.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal transfer mechanisms Figma relies on for cross-border personal data flows from the EU, UK, and Switzerland to the US and other jurisdictions, and discloses that transferred data may be subject to government access requests in destination jurisdictions.
The updated terms establish specific restrictions on how Figma may use personal information collected from minors. Children under 13 in the US, under 16 in California and the EU, and under 18 in Japan may now use the Services only through agreements with educational institutions. Figma states it will not use children's personal information to train, fine-tune, or improve AI services, nor will it permit service providers to do so. The policy also prohibits using children's data for marketing purposes, targeted advertising, or enabling third-party tracking. If a parent learns their child provided personal information without consent outside an educational agreement, they may contact Figma to report the issue.
View change record →Under this clause, personal information collected from EU, UK, and Swiss users is transferred to and stored in the United States, with Standard Contractual Clauses serving as the primary legal transfer mechanism for non-adequacy-decision jurisdictions. The policy acknowledges that destination jurisdictions may have data protection laws that are less protective than the laws in the user's home country, and that data may be subject to government access requests in those jurisdictions.
Cross-platform context
See how other platforms handle International Data Transfers and Standard Contractual Clauses and similar clauses.
Compare across platforms →Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Where we transfer your personal information to countries and territories outside of the European Economic Area ("EEA"), Switzerland and the UK which have been formally recognized as providing an adequate level of protection for personal information, we rely on the relevant "adequacy decisions" and "adequacy regulations" from the European Commission, Swiss and UK authorities. Where the transfer is not subject to an adequacy decision or derogation under the applicable law, we take appropriate safeguards to ensure that your personal information will remain protected in accordance with this Privacy Policy and applicable laws. These safeguards include implementing the Module 2 of European Commission's Standard Contractual Clauses as issued on 4 June 2021 under Article 46(2) GDPR for transfers originating in the EEA, Switzerland (with amendments required under the applicable Swiss law) and the UK Addendum permitted under Article 46(2) of the UK GDPR for the transfer of data originating in the UK.Excerpt from Figma's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly implicates GDPR Chapter V (Articles 44-49) governing international data transfers, UK GDPR transfer requirements, and the Swiss Federal Act on Data Protection. The policy references Module 2 Standard Contractual Clauses issued June 4, 2021, which are the current European Commission-approved mechanism for controller-to-processor transfers. The EU-U.S. Data Privacy Framework is separately addressed in Section 7 as an additional compliance mechanism. Supervisory authorities in the EEA, UK, and Switzerland have enforcement authority over transfer compliance. 2. GOVERNANCE EXPOSURE: Medium. The policy discloses that sub-processors are listed at a separate URL (figma.com/sub-processors), and that SCCs have been implemented with those third-party service providers. However, the policy does not detail whether transfer impact assessments have been conducted for each destination jurisdiction, which European supervisory authorities have indicated may be required alongside SCCs where government access risks exist. The disclosure that data may be subject to government access requests in destination jurisdictions is a material risk disclosure that organizations subject to GDPR should document. 3. JURISDICTION FLAGS: EU and EEA users face the highest regulatory exposure, given ongoing supervisory authority scrutiny of US data transfers. UK users are covered by the UK Addendum mechanism. Swiss users are covered under the Swiss-U.S. DPF. Organizations in sectors with heightened data protection requirements (healthcare, financial services, public sector) should assess whether the SCC mechanism alone is sufficient for their specific data categories. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should request and review Figma's Data Processing Addendum and the specific SCCs implemented, and verify that the sub-processor list at figma.com/sub-processors is current and covers all relevant data processing activities. DPA terms regarding sub-processor change notification procedures should be assessed for compatibility with customer obligations under their own data processing agreements. 5. COMPLIANCE CONSIDERATIONS: Organizations subject to GDPR should document Figma as a third-country data processor in their Records of Processing Activities and maintain copies of the applicable SCCs. Transfer impact assessments may be warranted depending on the organization's risk profile and the sensitivity of data processed through Figma. Any changes to the sub-processor list should trigger review under applicable GDPR sub-processor change notification requirements.
This provision establishes the legal transfer mechanisms Figma relies on for cross-border personal data flows from the EU, UK, and Switzerland to the US and other jurisdictions, and discloses that transferred data may be subject to government access requests in destination jurisdictions.
Under this clause, personal information collected from EU, UK, and Swiss users is transferred to and stored in the United States, with Standard Contractual Clauses serving as the primary legal transfer mechanism for non-adequacy-decision jurisdictions. The policy acknowledges that destination jurisdictions may have data protection laws that are less protective than the laws in the user's home country, and that …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.