Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision states that when users interact with or enable content sharing with third-party federated services, Threads transmits user profile information, post content, attachments, and metadata (including server IP address and interaction timestamps) to those external services, which then store and process that data under their own terms. The policy frames this transmission as user-directed, occurring when users enable interoperable capabilities or interact with third-party content.
This analysis describes what Threads's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that data transmitted to third-party federated services exits Meta's data governance perimeter and becomes subject to the terms and policies of those external services. Compliance teams must account for this data flow boundary when conducting data mapping, assessing data subject rights fulfillment, or evaluating cross-border data transfer obligations.
Under this provision, user profile information, post content, photo and video attachments, and interaction metadata are transmitted to third-party federated services that operate outside Meta's control and under their own privacy terms. The agreement states that users with public profiles may have their information shared with third-party services when those services' users interact with their content, including through likes or replies, without the Threads user needing to initiate the specific interaction.
Cross-platform context
See how other platforms handle Federated Third-Party Data Transmission and similar clauses.
Compare across platforms →Monitoring
Threads has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When you interact with content or people from Third Party Services or otherwise make your content available to Third Party Services, please be aware that you are directing us to deliver your information to services not controlled by Meta as necessary to integrate with the interoperable protocol, so that your information can be stored and processed by the Third Party Services. For example, when you have a follower who is a Third Party User, we will share a copy of your post and your information to this follower's Third Party Service so that it can store, process, and deliver the post to your follower. The information we share with the Third Party Service will depend on your activity, but usually will include your profile information (such as your username, name, profile picture, and bio), and could also include things like the content of the comment, interaction, or post, including any attachments such as photos or videos, and certain metadata associated with your interaction, such as IP address of our Threads server and the timestamp of the interaction. Information sent to Third Party Services is no longer in Meta's control and is subject to the terms and policies of those Third Party Services.Excerpt from Threads's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR (particularly provisions related to controller responsibilities, data transfers, and the right to erasure), CCPA (regarding the scope of data sharing disclosures and consumer rights), and potentially ePrivacy Directive obligations where metadata including IP addresses is transmitted. The EU General Data Protection Board and national data protection authorities in the EU/EEA are the primary enforcement bodies. The transmission of EU user data to third-party federated services, which may operate in jurisdictions without adequacy decisions, may require evaluation under GDPR international transfer mechanisms. (2) GOVERNANCE EXPOSURE: High. The provision discloses that user data including IP addresses, post content, attachments, and profile metadata is transmitted to third-party services outside Meta's control. For enterprise users or regulated-industry organizations, this creates a data flow that may not be captured in existing privacy impact assessments or vendor management frameworks, particularly given that recipient third-party services are not enumerated or contractually bound to Meta's data governance standards. (3) JURISDICTION FLAGS: EU/EEA users face heightened exposure given GDPR's strict requirements on international data transfers and the right to erasure. California residents may evaluate this disclosure under CCPA's data sharing definitions. The transmission of data to open federated network participants, which may include servers in non-adequate jurisdictions, creates particular exposure for organizations subject to GDPR Chapter V transfer restrictions. (4) CONTRACT AND VENDOR IMPLICATIONS: This provision does not enumerate recipient third-party services, which limits vendor due diligence. Procurement or compliance teams in regulated industries cannot readily assess the data handling practices of all potential recipient federated services. The policy frames the transmission as user-directed rather than as a Meta-initiated data sharing relationship, which may affect how liability for downstream data handling is assessed. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should update data flow maps to reflect federated data transmission as a data sharing pathway. Organizations subject to GDPR should evaluate whether this transmission constitutes a data transfer requiring a legal basis under Chapter V, and whether existing privacy notices adequately disclose the federated architecture. Teams should assess whether the policy's framing of the transmission as user-directed is consistent with applicable regulatory guidance on consent and controller responsibilities.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that data transmitted to third-party federated services exits Meta's data governance perimeter and becomes subject to the terms and policies of those external services. Compliance teams must account for this data flow boundary when conducting data mapping, assessing data subject rights fulfillment, or evaluating cross-border data transfer obligations.
Under this provision, user profile information, post content, photo and video attachments, and interaction metadata are transmitted to third-party federated services that operate outside Meta's control and under their own privacy terms. The agreement states that users with public profiles may have their information shared with third-party services when those services' users interact with their content, including through likes or …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Threads.