Legal Rights & Agreement Rules · Company commitment
Meta follows the DPF for EEA and Swiss personal information only in relation to the Certified Data Categories
Meta says it follows the DPF for all personal information it receives from the EEA or Switzerland under the DPF, in relation to the Certified Data Categories. Footnote 1 lists those categories (Facebook and Messenger, Instagram including Threads, Meta Business Tools, Workplace, Ads and measurement, AI, Meta Platforms Technologies Products, Research, Payment functionality, WhatsApp, plus other categories whose own policies link to this Disclosure). Personal information outside those categories is not covered by this statement.
Supporting quotations
What this disclosure covers
Meta follows the DPF for all personal information received from the EEA or Switzerland under the DPF in relation to the Certified Data Categories[1].
Qualifications & exceptions
The commitment is limited to information received “under the DPF” and to the Certified Data Categories; the footnote's last entry lets other Meta product policies add categories by linking to this Disclosure.
Not stated here
Whether a particular Meta product or data flow falls within a Certified Data Category depends on the linked product policies, which were not supplied.
Data types, purposes, sharing, access, choices and legal requests are in the linked Privacy Policy and other policies
This Disclosure does not itself describe Meta's data practices. It refers readers to the relevant Privacy Policy and/or the other policies associated with each Certified Data Category for: the types of personal information processed; the purposes of processing; the types of third parties to which personal information is disclosed; an individual's right to access personal information; the choices and means offered to limit use and disclosure; and how personal information is disclosed in response to legal requests when necessary.
Supporting quotations
Please see the relevant [Privacy Policy](https://www.facebook.com/privacy/policy?entry_point=POLICY_SECTION%3A1-WhatThisDisclosureCovers) and/or other policies associated with the Certified Data Categories[1] for details about:
The types of personal information processed
The purposes for which personal information is processed
The types of third parties to which personal information is disclosed
An individual’s right to access personal information
Any choices and means offered to limit the use and disclosure of personal information
How personal information is disclosed in response to legal requests when necessary
Not stated here
The Privacy Policy and the other category-specific policies were not supplied; the actual types, purposes, recipients, access procedures and choices are unknown from this text.
Legal Rights & Agreement Rules · Context
Footnote 1: the Certified Data Categories are the product categories under Meta Platforms, Inc.'s DPF certifications
Footnote 1 explains that Meta Platforms, Inc.'s certifications to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks, as described in this Disclosure, relate to a list of Certified Data Categories. Each entry describes a product group, names which Meta entity acts as controller, processor or sub-processor, and links to the policy that gives more detail. The entries are carded separately.
Supporting quotations
1
Certified Data Categories Under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks
Meta Platforms, Inc.'s certifications to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, as described in the EU-U.S. and Swiss-U.S. Data Privacy Frameworks Disclosure, relate to the following Certified Data Categories:
Facebook and Messenger: Meta Platforms Ireland Limited is controller, Meta Platforms, Inc. is processor
For the Facebook and Messenger certified data category (social networking services for connecting with friends, family and people with shared interests, including private communication, watching content, buying and selling through Marketplace or Shops, dating matches and community), Meta Platforms Ireland Limited is the controller and Meta Platforms, Inc. is a processor. More detail is in the linked Privacy Policy.
Supporting quotations
Facebook and Messenger: Social networking services that you can use to connect with friends, family and people who share the same interests, where Meta Platforms Ireland Limited is the controller and Meta Platforms, Inc. is a processor. You can communicate with others privately, watch your favourite content, buy and sell items through Marketplace or from brands and creators who sell on Shops, match with a date, and spend time with your community.
Not stated here
The linked Privacy Policy was not supplied.
Use & Processing · Company practice
Instagram, including Threads: Meta Platforms Ireland Limited is controller, Meta Platforms, Inc. is processor
For Instagram (a photo and video sharing app, with private communication, viewing, commenting, liking and buying from Shops) and apps such as Threads (an app from Instagram for viewing and sharing public conversations, posting threads, replying and following profiles), Meta Platforms Ireland Limited is the controller and Meta Platforms, Inc. is a processor. More detail is in the linked Privacy Policy and the Threads Supplemental Privacy Policy.
Supporting quotations
Instagram (including apps such as Threads): Instagram is a photo and video sharing app that allows you to upload photos and videos, and share them with friends and followers. You can also communicate with others privately, view, comment and like posts shared by friends on Instagram, and discover and buy from brands and creators who sell on Shops. Threads is an app from Instagram where you can view and share public conversations. Depending on how you use Threads, you can also post threads, reply to others and follow profiles that you're interested in. Threads and replies can include short pieces of text, links, photos, videos or any combination of these. For Instagram and Threads, Meta Platforms Ireland Limited is the controller and Meta Platforms, Inc. is a processor.
Not stated here
The linked Privacy Policy and Threads Supplemental Privacy Policy were not supplied.
Data Access & Collection · Company practice
Meta Business Tools: pixel, Conversions API, SDK events, social plugin and Login data; Meta roles depend on the service
The Meta Business Tools certified data category covers technologies that let website owners, publishers, app developers and partners (including advertisers) integrate with Meta, measure their products and services, and reach people. It names Meta pixel, the Conversions API, App Events through Facebook SDK, Offline Conversions and App Events API. Meta also receives Business Tools data as impression data from Facebook social plugins (for example the Like and Share buttons) and Facebook Login, from certain APIs, and from certain pilot, test, alpha or beta programmes it may offer. Depending on the service, Meta Platforms Ireland Limited is the controller or processor and Meta Platforms, Inc. is a processor or sub-processor, respectively.
Supporting quotations
Meta Business Tools: Technologies that help website owners, publishers, app developers and partners (including advertisers and others) integrate with Meta, understand and measure their products and services, and better reach and serve people who use or might be interested in their products and services. These Business Tools include Meta pixel, the Conversions API, App Events through Facebook SDK, Offline Conversions and App Events API. We also receive Business Tools data in the form of impression data sent by Facebook social plugins (for example, the Like and Share buttons) and Facebook Login, as well as data from certain APIs and from certain pilot, test, alpha or beta programmes that we may offer. Depending on the service, Meta Platforms Ireland Limited is the controller or processor and Meta Platforms, Inc. is a processor or sub-processor, respectively.
Qualifications & exceptions
The role allocation is stated as “Depending on the service”; the text does not say which services put Meta Platforms Ireland Limited in the controller role.
Not stated here
The linked Privacy Policy and Business Tools page were not supplied.
Use & Processing · Company practice
Workplace: customer organisations are controllers, Meta Ireland is processor, Meta Platforms, Inc. is sub-processor
For Workplace (a service for collaborating and sharing information at work), the customer organisations are the data controllers and may share personal information about their end users with Meta; Meta Platforms Ireland Limited is the processor and Meta Platforms, Inc. is a sub-processor. Customers and their end users decide what to share, but it typically includes business contacts, customer and employee information, user-generated content and communications, and other information under the customer's control. End users are directed to the customer that manages their Workplace account and to Workplace's Privacy Policy for more information.
Supporting quotations
Workplace: A service that allows people to more effectively collaborate and share information at work. Customers (organisations who are the data controllers) may share personal information about their end users to Meta, with Meta Platforms Ireland Limited as the processor and Meta Platforms, Inc. as a sub-processor. While customers and their end users decide what information to share, they typically include things such as business contacts, customer and employee information, user-generated content and communications, and other information under the customer's control. For more information, end users may contact the customer who manages their Workplace account and review Workplace's
Not stated here
Workplace's Privacy Policy was not supplied.
Data Access & Collection · Company practice
Ads and measurement: partner data with Meta Ireland as processor; Meta Audience Network with Meta Ireland as controller
Beyond the Business Tools, Meta offers other ads and measurement products and may receive personal information from unaffiliated partners, who are the data controllers; for those products Meta Platforms Ireland Limited is the processor and Meta Platforms, Inc. is a sub-processor. The information processed includes contact information and information about individuals' experiences or interactions with the partners and their products, services and ads. Meta also offers ads products such as Meta Audience Network, for which Meta Platforms Ireland Limited is a controller and Meta Platforms, Inc. is a processor.
Supporting quotations
Ads and measurement: In addition to Meta Business Tools, Meta offers other ads and measurement products and may receive personal information from unaffiliated partners (the data controllers), where Meta Platforms Ireland Limited is the processor and Meta Platforms, Inc. is a sub-processor. Information processed for ads and measurement products includes things such as contact information and information about individuals' experiences or interactions with the partners and their products, services and ads. Meta also offers ads products such as Meta Audience Network, where Meta Platforms Ireland Limited is a controller and Meta Platforms, Inc. is a processor.
Qualifications & exceptions
Meta “may receive” partner personal information; the role allocation differs between partner-sourced ads and measurement products and Meta Audience Network.
Not stated here
The linked About Facebook ads page and Privacy Policy were not supplied.
Use & Processing · Context
AI: generative AI features such as Meta AI, their models, and models released through an open platform
The AI certified data category is “AI at Meta”: Meta's collection of generative AI features and experiences, such as Meta AI, together with the models that power them, and also making models available through an open platform for researchers, developers and others in the AI community. For how these models use information, the Disclosure points to the AI at Meta page and the Privacy Policy. Unlike the other categories, this entry does not say which Meta entity is controller or processor.
Supporting quotations
AI: AI at Meta is our collection of generative AI features and experiences, like Meta AI, along with the models that power them. This also includes making models available through an open platform to support researchers, developers and others in the AI community.
Not stated here
No controller, processor or sub-processor role is stated for the AI category in this Disclosure.
The AI at Meta page and Privacy Policy, which describe how the models use information, were not supplied.
Use & Processing · Company practice
Meta Platforms Technologies Products (VR/MR/AR devices, Horizon, Avatars, wearables, games): roles depend on the service
The Meta Platforms Technologies Products certified data category covers virtual, mixed and augmented reality products and services, including devices and accessories (such as Meta Quest and Samsung Gear VR), Meta Horizon Products (including Worlds, Workrooms and Managed Services), Avatars, Meta Wearable Products (such as the Meta Ray-Ban Display glasses) and Games (such as Beat Saber). Depending on the service, Meta Platforms Ireland Limited is the controller or processor and Meta Platforms, Inc. is a processor or sub-processor, respectively. More detail is in the linked Privacy Policy, the Supplemental Meta Platforms Technologies Privacy Policy and the Meta Platforms Technologies Products Definition.
Supporting quotations
Meta Platforms Technologies Products: A collection of virtual, mixed and augmented reality products and services, including: Devices and accessories (such as Meta Quest and Samsung Gear VR), Meta Horizon Products (including Worlds, Workrooms, and Managed Services), Avatars, Meta Wearable Products (such as the Meta Ray-Ban Display glasses), and Games (such as Beat Saber). Depending on the service, Meta Platforms Ireland Limited is the controller or processor and Meta Platforms, Inc. is a processor or sub-processor, respectively.
Not stated here
The three linked policies and the products definition were not supplied; which services carry which role is not stated here.
Use & Processing · Company practice
Research products and services: Meta Platforms Ireland Limited is controller, Meta Platforms, Inc. is processor
For the Research certified data category (research products and services used to conduct research that advances scholarship and innovation and promotes safety, security and integrity), Meta Platforms Ireland Limited is the controller and Meta Platforms, Inc. is a processor. Stated research goals include contributing to social good and areas of public interest, advancing technology, and improving safety, health and well-being.
Supporting quotations
Research: Research products and services used to conduct research that advances scholarship and innovation, and to promote safety, security and integrity, where Meta Platforms Ireland Limited is the controller and Meta Platforms, Inc. is a processor. Research goals include contributing to social good and areas of public interest, advancing technology, and improving safety, health and well-being.
Not stated here
The linked Privacy Policy was not supplied.
Charges & Financial Obligations · Company practice
Payment functionality: Facebook Payments International is controller; Meta Platforms, Inc. and Meta Payments process
For the Payment functionality certified data category (payment and related services that let users make purchases, donations or other payments on Meta Products), Facebook Payments International is the data controller and Meta Platforms, Inc. and/or Meta Payments, Inc are processors. Where applicable, the category also includes processing for legal obligations, including anti-money laundering, sanctions, counter terrorism, fraud prevention, monitoring and other regulatory purposes. More detail is in the linked Facebook Payments International Privacy Policy.
Supporting quotations
Payment functionality: Payment and related services that enable users to make purchases, donations or other payments on Meta Products, where Facebook Payments International is the data controller and Meta Platforms, Inc. and/or Meta Payments, Inc are processors. This also includes, where applicable, processing for legal obligations, including anti-money laundering, sanctions, counter terrorism, fraud prevention, monitoring and other regulatory purposes.
Not stated here
The Facebook Payments International Privacy Policy was not supplied.
Use & Processing · Company practice
WhatsApp: WhatsApp Ireland Limited is controller or processor; Meta Platforms, Inc. is processor or sub-processor
For the WhatsApp certified data category (a messaging, video and voice calling service for users and businesses, covering text, photos, videos, documents, voice recordings, location sharing and other media), WhatsApp Ireland Limited is a controller or processor as the case may be, and Meta Platforms, Inc. is a processor or sub-processor, respectively. The Disclosure defers to the WhatsApp Privacy Policy, the WhatsApp Channels Supplemental Privacy Policy and the WhatsApp Business Terms of Service for more information about the WhatsApp data category and the effective date for such transfers.
Supporting quotations
WhatsApp: WhatsApp is a messaging, video and voice calling service that allows users or businesses to communicate through a variety of media – including, but not limited to, text, photos, videos, documents, voice recording and location sharing – where WhatsApp Ireland Limited is a controller or processor as the case may be, and Meta Platforms, Inc. is a processor or sub-processor, respectively.
Qualifications & exceptions
The effective date for WhatsApp transfers under the DPF is not stated here; it is deferred to the WhatsApp Privacy Policy.
Not stated here
The three linked WhatsApp documents, including the transfer effective date, were not supplied.
Legal Rights & Agreement Rules · Context
Other Meta product data categories are certified when that product's Privacy Policy or Terms links to this Disclosure
Beyond the listed categories, a Meta Company product or service may have a Privacy Policy or Terms that links to this Disclosure for a particular data category not already specified. In that case the Disclosure says that data category is covered by Meta Platforms, Inc.'s DPF certification and is a certified data category. Readers are told to check the relevant Privacy Policy and Terms for the product or service they use.
Supporting quotations
Other Meta data categories: In some cases, a Meta Company product or service will have a Privacy Policy or Terms that also links to our EU-U.S. and Swiss-U.S. Data Privacy Frameworks Disclosure for a particular data category that is not already specified above. This means that data category is covered by Meta Platforms, Inc.'s DPF certification and is a certified data category. Please refer to the relevant Privacy Policy and Terms for the product or service that you are using for further information.
Not stated here
Which Meta Company products or services currently link to this Disclosure, and for which data categories, is not stated and the linked policies were not supplied.
Meta's DPF compliance is subject to the U.S. Federal Trade Commission's investigatory and enforcement powers
Meta states that its compliance with the DPF is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. This identifies the U.S. agency that can investigate and enforce against Meta on DPF compliance; the Disclosure does not describe how the FTC exercises those powers.
Supporting quotations
Enforcement
Meta’s compliance with the DPF is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.
Sharing & Disclosure · Company commitment
Meta is liable for third parties' non-DPF processing of onward-transferred data unless not responsible for the event
In accordance with the DPF, Meta states that it is liable where it transfers personal information onward to third parties that then process it in a way that does not follow the DPF. The liability does not apply where Meta was not responsible for the event giving rise to the alleged damage.
Supporting quotations
In accordance with the DPF, Meta is also liable for onward transfers to third parties that process personal information in a way that does not follow the DPF unless Meta was not responsible for the event giving rise to any alleged damage.
Not stated here
The DPF's own onward-transfer liability rule, which this statement follows, was not supplied.
Legal Rights & Agreement Rules · User right or choice
Questions go to Meta by email; DPF certification disputes can be resolved free of charge through TRUSTe
Readers can email Meta with questions or concerns about its DPF certification. Applicable disputes with Meta related to the certification can be resolved free of charge through TRUSTe, an alternative dispute resolution provider based in the United States, reached through the linked TRUSTe Feedback and Resolution System.
Supporting quotations
Questions and disputes
Please email us with any questions or concerns about our DPF certification. You can resolve any applicable disputes with us related to our certification free of charge through TRUSTe, an alternative dispute resolution provider based in the United States. You can contact TRUSTe through the
Not stated here
No email address is given in this text; the linked TRUSTe form was not supplied.
What counts as an “applicable” dispute is not defined here.
Legal Rights & Agreement Rules · User right or choice
In some situations the DPF gives the reader a right to binding arbitration for complaints not resolved by other means
The Disclosure says that in some situations the DPF Framework gives the reader the right to invoke binding arbitration, to resolve complaints that were not resolved by other means, as described in Annex I to the DPF Framework (linked). The right is conditional and comes from the DPF itself, not from this Disclosure; the situations and procedure are in Annex I, which is not reproduced here.
Supporting quotations
In some situations, the DPF Framework gives you the right to invoke binding arbitration. You can do this to resolve complaints not resolved by other means, as described in Annex I to the
Not stated here
Annex I of the DPF Framework, which sets the situations and procedure, was not supplied.
Legal Rights & Agreement Rules · Company commitment
Meta Platforms, Inc. and its U.S. subsidiaries are certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks
Meta Platforms, Inc. and its wholly-owned U.S. subsidiaries (together called “Meta” in this Disclosure) state that they have certified their participation in the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (together, the “DPF”) with the U.S. Department of Commerce. The certification concerns Meta’s processing of personal information that it receives from the European Economic Area (“EEA”) and Switzerland under the DPF, in connection with that certification. The Disclosure is dated effective July 30, 2024. The later section “What this disclosure covers” limits this to the Certified Data Categories listed in footnote 1, so the certification does not by itself describe every Meta product; see the card on that section.
Supporting quotations
EU-U.S. and Swiss-U.S. Data Privacy Frameworks Disclosure for Meta Platforms, Inc.
Effective July 30, 2024
Meta Platforms, Inc. and its wholly-owned U.S. subsidiaries (collectively, “Meta”) have certified our participation in the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework (collectively, the "DPF") with the U.S. Department of Commerce. This certification relates to Meta’s processing of personal information received from the European Economic Area (“EEA”) and Switzerland under the DPF in connection with our
Qualifications & exceptions
The certification is stated to relate to processing of EEA and Swiss personal information received “under the DPF in connection with our certification”, not to all of Meta's processing.
The section “What this disclosure covers” says Meta follows the DPF for this information only in relation to the Certified Data Categories listed in footnote 1.
Not stated here
The certification record on the Department of Commerce DPF list and the DPF Principles are linked external documents and were not supplied; this Disclosure does not reproduce the Principles.
Which wholly-owned U.S. subsidiaries are covered is not listed here.
Legal Rights & Agreement Rules · Restriction or exception
If this Disclosure conflicts with the DPF Principles, the Principles govern
Where the terms of this Disclosure conflict with the DPF Principles, the DPF Principles control, not the Disclosure. This means the Disclosure is subordinate to the Principles it describes; a reader cannot rely on this text where it says something narrower or different from the Principles.
Supporting quotations
If there is any conflict between the terms in this Disclosure and the DPF Principles, the Principles shall govern.
Not stated here
The DPF Principles are not reproduced or supplied here, so which specific terms might conflict cannot be determined from this Disclosure.
Readers are pointed to the DPF website to learn about the DPF and review Meta's certification on the DPF list
To learn more about the DPF, or to review Meta's certification entry on the DPF list, the Disclosure directs readers to the linked DPF website. The Disclosure itself does not reproduce the certification details.
Supporting quotations
To learn more about the DPF, or to review our [certification](https://lm.facebook.com/l.php?u=https%3A%2F%2Fwww.dataprivacyframework.gov%2Fs%2Fparticipant-search%2Fparticipant-detail%3Fid%3Da2zt0000000GnywAAC%26status%3DActive&h=AUBeEpakz15BEOUku9XH37HzinTlNlIy694bH3VrAaMfhxAGZncbyhHXOoliCptTgDyvyGiAJVRIr5CpJ4u1n7BTkpovoUG6b0tJTucGmCxMqr7Lx08l_fi4nXRUD6ihrCuypIx1EhhqYsXo) on the DPF list, visit the DPF
Not stated here
The linked DPF website and participant entry were not supplied.