Figma certifies compliance with the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF, and commits to resolve DPF-related complaints within 45 days, with unresolved complaints referred to JAMS at no cost to the complainant.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a defined complaint and dispute resolution pathway for EU, UK, and Swiss residents regarding personal data handling, with the DPF Principles taking precedence over conflicting policy terms and binding arbitration available as a final recourse under the DPF framework.
The updated terms establish specific restrictions on how Figma may use personal information collected from minors. Children under 13 in the US, under 16 in California and the EU, and under 18 in Japan may now use the Services only through agreements with educational institutions. Figma states it will not use children's personal information to train, fine-tune, or improve AI services, nor will it permit service providers to do so. The policy also prohibits using children's data for marketing purposes, targeted advertising, or enabling third-party tracking. If a parent learns their child provided personal information without consent outside an educational agreement, they may contact Figma to report the issue.
View change record →Under this clause, EU, UK, and Swiss residents may submit complaints about Figma's personal data handling practices directly to Figma, with a 45-day resolution commitment, and may escalate unresolved complaints to JAMS at no charge. The agreement states that DPF Principles govern in the event of any conflict with the privacy policy terms.
Cross-platform context
See how other platforms handle EU-U.S. Data Privacy Framework Certification and Dispute Resolution and similar clauses.
Compare across platforms →"Figma, Inc. (for the purposes of this section, "Figma", "we", or "us") complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Figma has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the DPF Principles, the DPF Principles shall govern. We commit to resolve DPF-related complaints about our collection and use of your personal information. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of personal information received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact us using the contact details provided below. We will investigate and attempt to resolve any DPF-related complaints or disputes within forty-five (45) days of receipt. If you have an unresolved DPF complaint that we have not addressed satisfactorily, we have further committed to refer unresolved complaints to JAMS Data Privacy Dispute Resolution Program, an independent dispute resolution provider located in the U.S. made available free of charge.Excerpt from Figma's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a defined complaint and dispute resolution pathway for EU, UK, and Swiss residents regarding personal data handling, with the DPF Principles taking precedence over conflicting policy terms and binding arbitration available as a final recourse under the DPF framework.
Under this clause, EU, UK, and Swiss residents may submit complaints about Figma's personal data handling practices directly to Figma, with a 45-day resolution commitment, and may escalate unresolved complaints to JAMS at no charge. The agreement states that DPF Principles govern in the event of any conflict with the privacy policy terms.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.