Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes third-party advertising partners to deploy tracking technologies on Figma's services to collect IP addresses, cookie identifiers, pages visited, location, and time-of-day data for the purpose of delivering targeted advertisements to users on third-party networks.
This analysis describes what Figma's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that behavioral data collected on Figma's platform by third-party advertising partners is used for interest-based advertising across external third-party networks, creating a data flow from Figma's services to external advertising ecosystems that users may not directly observe.
The updated terms establish specific restrictions on how Figma may use personal information collected from minors. Children under 13 in the US, under 16 in California and the EU, and under 18 in Japan may now use the Services only through agreements with educational institutions. Figma states it will not use children's personal information to train, fine-tune, or improve AI services, nor will it permit service providers to do so. The policy also prohibits using children's data for marketing purposes, targeted advertising, or enabling third-party tracking. If a parent learns their child provided personal information without consent outside an educational agreement, they may contact Figma to report the issue.
View change record →Under this clause, third-party advertising partners may collect IP addresses, cookie identifiers, browsing activity, location data, and time-of-day information through Figma's services and use that data to deliver targeted advertisements on third-party websites and services. The agreement identifies opt-out mechanisms including the 'Manage Cookies' footer link and industry opt-out websites, though cookie-based opt-outs are stated to be ineffective on mobile applications.
Cross-platform context
See how other platforms handle Third-Party Advertising Partner Tracking and similar clauses.
Compare across platforms →Monitoring
Figma has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Through our Services, we allow third-party advertising partners to set Technologies and other tracking tools to collect information regarding your activities and your device (e.g., your IP address, cookie identifiers, page(s) visited, location, time of day). These advertising partners use this information (and similar information collected from other websites) for purposes of delivering targeted advertisements to you when you visit third-party services within their networks. This practice is commonly referred to as "interest-based advertising" or "personalized advertising."Excerpt from Figma's Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates GDPR requirements regarding consent for non-essential cookies and tracking technologies under the ePrivacy Directive, CCPA provisions regarding the sale and sharing of personal information for targeted advertising, and FTC Act Section 5 regarding unfair or deceptive practices in data collection. The policy states that Figma processes GPC signals as opt-outs from sale or sharing under CCPA, which engages California's opt-out of sale and sharing requirements. The FTC has general consumer protection jurisdiction over interest-based advertising disclosures. 2. GOVERNANCE EXPOSURE: Medium. The advertising partner tracking disclosure is a commonly observed practice, but the scope of data collected (IP address, location, cookie identifiers, behavioral data) and its use across third-party networks creates data flows that may require documentation in GDPR Records of Processing Activities and CCPA data maps. The policy's acknowledgment that cookie-based opt-outs do not function on mobile applications may create gaps in opt-out mechanism effectiveness that regulators in the EU and California have scrutinized in comparable contexts. 3. JURISDICTION FLAGS: EU and UK users have heightened exposure, as cookie consent for non-essential advertising technologies requires affirmative opt-in under the ePrivacy Directive and GDPR as interpreted by supervisory authorities. California users are protected by CCPA opt-out of sale and sharing rights, which the policy states are accessible via the 'Manage Cookies' link. The mobile application gap in opt-out effectiveness may create specific compliance exposure in jurisdictions with active enforcement of cookie and tracking requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers whose employees use Figma in jurisdictions with strict tracking consent requirements should verify that Figma's cookie consent tool satisfies applicable standards and that advertising partner data flows are disclosed in vendor assessments. The list of advertising technology partners is not enumerated in the policy text, which may complicate vendor due diligence. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Figma's cookie consent tool provides genuine opt-in for EU and UK users prior to advertising tracking technologies being set, consistent with supervisory authority guidance. Organizations should document the advertising partner tracking disclosure in their records of third-party data sharing and assess whether this use of employee data on Figma's platform aligns with their own internal data governance policies.
This provision establishes that behavioral data collected on Figma's platform by third-party advertising partners is used for interest-based advertising across external third-party networks, creating a data flow from Figma's services to external advertising ecosystems that users may not directly observe.
Under this clause, third-party advertising partners may collect IP addresses, cookie identifiers, browsing activity, location data, and time-of-day information through Figma's services and use that data to deliver targeted advertisements on third-party websites and services. The agreement identifies opt-out mechanisms including the 'Manage Cookies' footer link and industry opt-out websites, though cookie-based opt-outs are stated to be ineffective on mobile …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Figma.