Figma is a browser-based design/collaboration platform operated by Figma, Inc., which completed its IPO on the New York Stock Exchange (ticker FIG) in August 2025. Figma's own privacy policy and AI terms disclose routine account data collection plus optional, admin-toggle-gated use of Customer Content to train AI models, and separately disclose use of pixel tags/web beacons to record page visits and ad clicks. Figma's CCPA disclosure self-classifies identifiers, network activity, and behavioral inferences it discloses to advertising networks as a "sale"/"sharing" for cross-context behavioral advertising. Figma's FY2025 Form 10-K (SEC EDGAR) confirms the corporate/ownership structure and states that while the company has experienced cybersecurity incidents, none to date has had a material impact on its business or operations; Figma also publishes an annual Transparency Report describing government data-request handling. No regulatory action, breach disclosure, or settlement was found in the fetched sources.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
14 ON FILE
COLLECTION
Figma's AI terms state that when a customer's "Content Training" toggle is on, Figma may use that customer's Content to maintain, improve, and enhance its products by training machine learning and AI algorithms and models -- an opt-in/opt-out setting rather than a mandatory default.
Figma's privacy policy states that creating a Figma account collects name, email address, personal website, and profile picture, plus a phone number if the user enables phone-based two-factor authentication.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes.
Figma, Inc.'s Form 10-K for fiscal year 2025, filed with the SEC, confirms the company's Class A common stock began trading on the New York Stock Exchange on July 31, 2025 under ticker symbol FIG.
Figma's privacy policy discloses that, under the CCPA, the categories of personal information it has "sold" or "shared" for cross-context behavioral advertising in the prior twelve months include identifiers, internet/electronic network activity, and inferences drawn to create a consumer profile, all disclosed to advertising networks.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
As assessed by PrivacySpy on 2020-06-24 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
Figma publishes an annual Transparency Report, stating it provides customers with information regarding the number and types of government requests for data it receives and how it responds to them.
Figma's FY2025 Form 10-K states that the company has experienced cybersecurity incidents but, as of the filing date, is not aware of any incidents that have had a material impact on its business, operating results, or financial condition -- no regulator order, breach notice, or settlement was found elsewhere.
Figma's privacy policy states that it and third parties providing content, advertising, or other functionality use pixel tags/web beacons -- code embedded in the Services that records, for example, that a user visited a particular page or clicked a particular advertisement.