8 Total
4 High severity
4 Medium severity
0 Low severity
Summary

This is Meta's unified Privacy Policy covering how Meta collects and uses personal data across Facebook, Instagram, Messenger, WhatsApp, and Meta Quest. The policy states that Meta collects location data, device identifiers, browsing and app activity on third-party sites via tools like Meta Pixel, transaction data, camera and microphone data, and inferences about political views, religion, and health, and uses this information to serve personalized advertising across Meta's family of products. The policy also states that Meta shares user data with advertisers, measurement partners, third-party app developers, and 'data providers' (described as companies that supply additional information to supplement Meta's own data), and combines information across all Meta-owned products for these purposes.

Technical / Legal Breakdown

This document is Meta's Privacy Policy governing the collection, use, and sharing of personal data across Meta's family of products including Facebook, Instagram, Messenger, WhatsApp, and associated third-party integrations, with Meta Platforms, Inc. (for US users) and Meta Platforms Ireland Limited (for users elsewhere) identified as the data controllers. The policy states that Meta collects identifiers, device and browser information, location data, content and communications, activity data across Meta products and third-party sites and apps, transaction information, camera and microphone data, and inferred attributes including political views, religious beliefs, and health information for purposes including personalized advertising, product development, safety, and measurement. The policy authorizes cross-product data combination across Facebook, Instagram, WhatsApp, Messenger, and Meta Quest, as well as sharing with advertisers, measurement partners, third-party apps, data brokers described as 'data providers,' and entities in the Meta corporate family; the breadth of sensitive inferred data use for ad targeting and the cross-context behavioral tracking across third-party sites and apps via Meta Pixel and similar tools is operationally distinct from policies that limit such practices. The policy engages GDPR and the UK GDPR for European and UK users, the CCPA and CPRA for California residents, and general FTC Act consumer protection standards applicable in the United States; the document identifies legitimate interests and contractual necessity as legal bases alongside consent in certain contexts, and the applicability of specific rights such as opt-out of data sale or sharing, right to deletion, and right to restrict processing depends heavily on the user's jurisdiction. The policy states that users in the EU, UK, and certain other regions have additional rights including data portability, objection to processing, and lodging complaints with supervisory authorities, while users outside those jurisdictions operate under fewer explicit statutory protections as reflected in the document.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Start Compliance free trial

5 important changes detected

6 versions captured · Last updated: May 2026

What changed Meta updated its privacy policy on May 5, 2026 with primarily editorial and formatting changes. The company changed terminology from 'Privacy Center' to 'Privacy Centre', updated phrasing like 'our Products' to 'our products', and rewrote some sentences for clarity (for example, 'How long do we keep your information?' became 'How long do we keep your information for?'). These appear to be style, localization, and grammatical refinements rather than substantive changes to how Meta collects, uses, or shares your data.
Why this matters The detected changes are primarily editorial refinements and terminology updates (such as 'Privacy Center' to 'Privacy Centre' and grammatical rewording) rather than substantive modifications to Meta's data collection, use, or sharing practices. The policy's core commitments and your rights under it remain unaffected by these updates. No action is required in response to this specific change.
View full change record →
What changed Meta removed a reference to the United States Regional Privacy Notice from its Privacy Policy on April 21, 2026, streamlining the header section. The policy no longer explicitly directs US residents to that separate document for details about their consumer privacy rights. This makes the primary Privacy Policy less clear about where to find information on exercising rights under US state privacy laws.
Why this matters The updated Privacy Policy no longer explicitly directs US residents to the United States Regional Privacy Notice, which previously provided details about consumer privacy rights available under state laws like the California Consumer Privacy Act and similar regulations. This removal does not eliminate those rights themselves, but it makes the Privacy Policy less clear about where consumers can find information on how to exercise those rights. Consumers can still locate the Regional Privacy Notice through Meta's website or by searching for it directly, but the removal reduces the accessibility and prominence of that guidance within the primary policy document.
View full change record →

April 19, 2026 low

Meta Ads restructured their privacy policy on April 19, 2026 by adding 219 new sentences and reorganizing the document with a clearer table of contents. The policy now includes distinct …

View change record →
April 18, 2026 low

Meta Ads updated its Privacy Policy on April 18, 2026 by adding nine new section headings that organize how it collects, uses, shares, and manages user data. The policy previously …

View change record →
March 11, 2026 low

Meta updated the title of its privacy policy on March 11, 2026, changing an en dash to a hyphen in the document header. The substantive content and disclosures about how …

View change record →

Recent Provision Changes Apr 19, 2026

10 provisions unchanged.

View full change record →
High — 4 provisions
Medium — 4 provisions

Monitoring

Meta Ads has updated this document before.

Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.

Start Monitor free trial Or create a free account →

Compliance Governance Intelligence

Need provision-level monitoring and regulatory mapping?

Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.

Start Compliance free trial

Cross-platform context

See how other platforms handle Advertising Personalization and Targeting and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

CCPA/CPRA
California, USA
View official text ↗
Connecticut Data Privacy Act Amendments
US-CT
View official text ↗
CAN-SPAM
United States Federal
View official text ↗
DMA
European Union
View official text ↗
FTC Act Section 5
United States Federal
View official text ↗
GDPR
European Union
View official text ↗
Indiana Consumer Data Protection Act
US-IN
View official text ↗
Kentucky Consumer Data Protection Act
US-KY
View official text ↗
Universal Opt-Out Mechanism Expansion 2026
US
View official text ↗
VPPA
United States Federal
View official text ↗
Archival ProvenanceSource & Archival Record
Last Captured May 5, 2026 06:36 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000021
Version ID CA-V-002145
SHA-256 50b6218559a3c08c1f56cc69d78b5a5cda74e53fe43fc612433df5ac94a0ae9d
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.

Create free account Compare plans