Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Meta collects, stores, publishes, and applies automated and manual processing to information with special protections that users choose to provide, including religious views, sexual orientation, political views, health data, racial or ethnic origin, philosophical beliefs, and trade union membership, for purposes of sharing with chosen contacts, personalizing and improving Products, and conducting analytics.
This analysis describes what Meta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that special-category data as defined under GDPR and equivalent frameworks is processed for product personalization and analytics purposes, not solely for sharing with user-selected contacts, which may require evaluation of whether the explicit consent standard applicable to such data is satisfied and whether the processing purposes are sufficiently specific.
Interpretive note: The policy's assertion that special-category data is processed where users 'choose to provide' it or give 'explicit consent' may not fully satisfy GDPR Article 9's requirements for explicit and specific consent to each processing purpose, and the adequacy of this mechanism depends on jurisdiction-specific enforcement interpretation.
Explicitly authorizes automated processing and publishing of sensitive personal data (health, religion, sexual orientation, race) for ad personalization and analytics, subject to GDPR special categories.
View full change record →Under this clause, sensitive personal information including health data, sexual orientation, religious views, and political views that users provide on Meta Products may be processed using automated and manual review for product personalization and analytics, in addition to being shared with contacts the user designates. The agreement notes this processing requires applicable legal protections and, where applicable, explicit consent.
Cross-platform context
See how other platforms handle Special-Category Data Processing and similar clauses.
Compare across platforms →Monitoring
Meta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Processing information subject to special protections under applicable laws that you provide so we can share it with those you choose, to provide, personalize and improve our Products and to undertake analytics. We'll collect, store, publish and apply automated, or sometimes manual (human), processing for these purposes... Any information with special protections that you choose to provide, such as your religious views, your sexual orientation, political views, health, racial or ethnic origin, philosophical beliefs or trade union membership, or as part of surveys you choose to participate in, or where you have given your explicit consent.Excerpt from Meta's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages GDPR Article 9, which prohibits processing of special categories of personal data absent a lawful basis, most commonly explicit consent or another enumerated exception. The Irish Data Protection Commission has supervisory authority for EU users. Equivalent protections exist under UK GDPR, and several US states (including California under CPRA) provide heightened protections for sensitive personal information categories. 2) GOVERNANCE EXPOSURE: High. The use of special-category data for product personalization and analytics beyond the specific sharing purpose the user intended is a materially significant processing purpose. Compliance teams should assess whether the consent mechanism for this processing meets the explicit and granular consent standard required under GDPR Article 9 and equivalent frameworks. 3) JURISDICTION FLAGS: EU and EEA users face the highest regulatory exposure given GDPR Article 9's strict requirements. UK users are similarly positioned. California residents have statutory rights under CPRA regarding sensitive personal information. Illinois users may have additional considerations depending on data types involved. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations whose employees or customers use Meta Products and may provide special-category data should assess whether this processing affects their own obligations as data controllers, particularly in healthcare, financial services, or other regulated industries. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate the adequacy of consent mechanisms for special-category data, ensure data mapping documentation identifies special-category data flows to Meta, and assess whether product personalization use of this data is within the scope of what users were informed of and consented to at the time of collection.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that special-category data as defined under GDPR and equivalent frameworks is processed for product personalization and analytics purposes, not solely for sharing with user-selected contacts, which may require evaluation of whether the explicit consent standard applicable to such data is satisfied and whether the processing purposes are sufficiently specific.
Under this clause, sensitive personal information including health data, sexual orientation, religious views, and political views that users provide on Meta Products may be processed using automated and manual review for product personalization and analytics, in addition to being shared with contacts the user designates. The agreement notes this processing requires applicable legal protections and, where applicable, explicit consent.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Meta.