Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The terms restrict developers to using platform-sourced data only for the specific purposes disclosed to users and permitted by Meta's policies, prohibiting use for purposes such as surveillance, selling data to third parties, or targeting based on sensitive attributes.
This analysis describes what Meta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision defines the permissible scope of data use for all platform-integrated applications, establishing that use of user data outside the stated core functionality or Meta's advertising policies constitutes a terms violation that may trigger audit, restriction, or termination of platform access.
Interpretive note: The term 'core functionality' is not precisely defined in the document, creating interpretive ambiguity for developers with broad or multi-purpose applications.
The updated terms remove developer restrictions that previously applied to large-scale platforms, meaning companies with more than 700 million monthly active users can now access Meta's AI models without special permission. The terms also eliminate the restriction on EU developers accessing multimodal models and consolidate account management under either managed accounts or Meta accounts. Developers previously subject to these restrictions should review whether the updated terms now permit their use case.
View change record →The updated terms authorize Meta to retain user-submitted content if its systems flag the content for a potential policy violation, in addition to retention tied to legal compliance and contractual rights. This expands the circumstances under which content may be preserved without explicit time limits. Under the revised language, content retention decisions may now be driven by automated policy-violation flagging in addition to legal or contractual necessity. Developers integrating the Llama API should understand that flagged content may be retained indefinitely pending policy review.
View change record →This new provision establishes a strict whitelist of permitted uses tied to core functionality and explicitly permits advertising use, creating a more permissive but narrowly-scoped data usage framework.
View full change record →Under this clause, developers accessing Meta platform data are contractually prohibited from using that data for purposes beyond those disclosed to users at the time of access grant, including selling the data or using it for unauthorized targeting or surveillance activities.
How other platforms handle this
You can limit to what extent we use your personal information for these purposes.
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
For data portability requests, We will select a format to provide Your personal information that is readily useable and should allow You to transmit the information from one entity to another entity without hindrance.
Monitoring
Meta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"You may only use Platform Data for the following purposes to the extent required to provide your app's core functionality: (a) to provide your product or service to users who have granted access to their Platform Data for that purpose; (b) for advertising purposes as described in our Advertising Policies; or (c) as otherwise permitted in these Terms.Excerpt from Meta's Llama API Terms of Service
1. REGULATORY LANDSCAPE: This provision engages GDPR Article 5(1)(b) (purpose limitation), CCPA's prohibitions on selling personal information without opt-out rights, and the FTC Act's prohibition on unfair or deceptive data practices. The Irish DPC and EU national supervisory authorities are primary enforcement bodies for EU/EEA data. The FTC has enforcement authority over US-based developers under the FTC Act. 2. GOVERNANCE EXPOSURE: High. Developers who use platform data for purposes beyond those disclosed at consent face simultaneous exposure under Meta's contractual enforcement mechanisms and applicable data protection law. The clause does not define 'core functionality' with precision, creating interpretive risk for developers with broad or evolving use cases. 3. JURISDICTION FLAGS: EU/EEA developers face the highest exposure given GDPR's strict purpose limitation requirements and significant administrative fine thresholds. California developers face exposure under CPRA's expanded purpose limitation obligations. Developers operating in health, financial, or children's services face additional sector-specific restrictions. 4. CONTRACT AND VENDOR IMPLICATIONS: Developers contracting with downstream data processors or analytics vendors must ensure those vendors' data use aligns with these restrictions, as the terms hold developers responsible for third-party data handling. Standard vendor DPAs should be reviewed to confirm sub-processing limitations are consistent with Meta's permitted use scope. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should audit all current use cases for platform data against the permitted purposes listed in these terms, update privacy notices to accurately reflect data use scope, and implement technical controls to prevent data use outside stated purposes. Data flow mapping should document each processing activity and its basis under these terms.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision defines the permissible scope of data use for all platform-integrated applications, establishing that use of user data outside the stated core functionality or Meta's advertising policies constitutes a terms violation that may trigger audit, restriction, or termination of platform access.
Under this clause, developers accessing Meta platform data are contractually prohibited from using that data for purposes beyond those disclosed to users at the time of access grant, including selling the data or using it for unauthorized targeting or surveillance activities.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Meta.