Do Not Track Non-Support

What it is

The policy discloses that Figure AI's services do not honor Do Not Track browser signals, and that cookies and similar tracking technologies including pixel tags, web beacons, clear GIFs, and JavaScript are used to collect web interaction and analytics data.

Why it matters (compliance & governance perspective)

Several U.S. state privacy laws, including the Colorado Privacy Act and Connecticut Data Privacy Act, require that services honor universal opt-out signals such as Global Privacy Control. The policy's statement that Do Not Track requests are not supported requires evaluation against these requirements, as Do Not Track and Global Privacy Control are distinct mechanisms and the policy does not address Global Privacy Control specifically.

Consumer impact (what this means for users)

Under this clause, Do Not Track browser signals are not honored, and cookies including performance and analytical cookies from third parties such as Google are placed on user devices. Users can opt out of Google Analytics cookies using the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/ or manage cookies through browser settings.

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: The Colorado Privacy Act, Connecticut Data Privacy Act, and other state privacy laws require that businesses honor universal opt-out signals, which may include Global Privacy Control (GPC) in addition to or instead of Do Not Track. The policy addresses Do Not Track but does not address GPC, which creates a potential compliance gap under applicable state laws. The FTC has indicated attention to opt-out signal compliance in consumer privacy enforcement. 2) GOVERNANCE EXPOSURE: Medium. If Figure AI's services are accessed by users in Colorado, Connecticut, or other states requiring GPC compliance, the absence of GPC honoring may constitute a violation of applicable state privacy law requirements. The policy's silence on GPC rather than explicit non-compliance creates interpretive uncertainty. 3) JURISDICTION FLAGS: Colorado, Connecticut, California (CCPA/CPRA as interpreted by the California Privacy Protection Agency), Montana, and Texas create heightened exposure for failure to honor universal opt-out signals. Compliance obligations are state-specific and depend on whether Figure AI meets applicable thresholds under each state's law. 4) CONTRACT AND VENDOR IMPLICATIONS: Third-party analytics vendors including Google Analytics should be evaluated for their role in cookie-based tracking and whether their data use practices align with user opt-out expectations under applicable state laws. Vendor data processing agreements should address opt-out signal compliance. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether Figure AI's services are required to honor Global Privacy Control or equivalent universal opt-out signals under applicable state privacy laws. A technical assessment of cookie categories and opt-out mechanisms should be conducted. If GPC compliance is required, the policy and technical infrastructure require updating.

Applicable agencies

Provision details

Other risks in this policy

• Consent-by-Use Mechanism medium
• Sensory Data Collection high
• Business Transfer Data Disclosure medium
• Data Retention Policy medium
• U.S. State Privacy Rights Exercise Process low
• No Targeted Advertising Sale Disclosure low