The policy states that Figma does not respond to Do Not Track signals but does recognize and process Global Privacy Control signals, treating them as opt-out requests from the sale or sharing of personal information for targeted advertising under CCPA definitions, with a secondary opt-out available via the 'Manage Cookies' footer link.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes Figma's treatment of browser-based privacy signals under CCPA, providing a mechanism through which California consumers may exercise opt-out rights without navigating a separate settings page, though the policy conditions recognition on the ability to 'reasonably associate' the GPC signal with an identifiable consumer.
Interpretive note: The policy conditions GPC recognition on the ability to 'reasonably associate' the signal with an identifiable consumer, and the operational threshold for this association is not defined in the document, creating uncertainty about GPC effectiveness in unauthenticated browsing contexts.
The updated terms establish specific restrictions on how Figma may use personal information collected from minors. Children under 13 in the US, under 16 in California and the EU, and under 18 in Japan may now use the Services only through agreements with educational institutions. Figma states it will not use children's personal information to train, fine-tune, or improve AI services, nor will it permit service providers to do so. The policy also prohibits using children's data for marketing purposes, targeted advertising, or enabling third-party tracking. If a parent learns their child provided personal information without consent outside an educational agreement, they may contact Figma to report the issue.
View change record →Under this clause, users with GPC-enabled browsers may have their opt-out of sale and sharing for targeted advertising recognized automatically, subject to Figma being able to reasonably associate the signal with an identifiable consumer. The agreement provides an alternative opt-out pathway through the 'Manage Cookies' link in the figma.com footer.
Cross-platform context
See how other platforms handle GPC Signal Processing and CCPA Opt-Out of Sale and Sharing and similar clauses.
Compare across platforms →""Do Not Track" and "Global Privacy Consent". Do Not Track ("DNT") and Global Privacy Consent ("GPC") signals are a privacy preferences that users can set in certain web browsers. We do not respond to DNT signals; however, we do recognize and process GPC signals by certain web browsers. If we are able to reasonably associate a GPC signal with an identifiable consumer, we will treat it as a request to opt-out of the "sale" or "sharing"/processing for targeted advertising of that consumer's personal information (as such terms are defined by the California Consumer Privacy Act). You can also opt out of the "sale" or "sharing" of your personal information by clicking on the "Manage Cookies" link in the footer of figma.com.Excerpt from Figma's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes Figma's treatment of browser-based privacy signals under CCPA, providing a mechanism through which California consumers may exercise opt-out rights without navigating a separate settings page, though the policy conditions recognition on the ability to 'reasonably associate' the GPC signal with an identifiable consumer.
Under this clause, users with GPC-enabled browsers may have their opt-out of sale and sharing for targeted advertising recognized automatically, subject to Figma being able to reasonably associate the signal with an identifiable consumer. The agreement provides an alternative opt-out pathway through the 'Manage Cookies' link in the figma.com footer.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.