facebook.com Privacy policy — 45/100 (High privacy risk)
Last analyzed
Meta Platforms, Inc. (formerly Facebook, Inc.) · facebook.com
Report details
High privacy riskFacebook's data policy collects vast amounts of personal data, shares it widely with third parties and other Meta companies, and transfers it globally with limited user control, posing significant privacy risks under EU law.
Facebook's Data Policy reveals extensive data collection from users, their devices, third-party apps, and partners, including sensitive information like location, payment details, and social connections. Data is shared broadly with third-party apps, advertisers (in non-personally identifiable form), vendors, and other Meta companies, with transfers outside the EEA justified via standard contractual clauses and user consent. While user rights like access, deletion, and ad controls are mentioned, the policy lacks clarity on AI/model training opt-outs, specific third-party recipients, and the legal basis for all processing activities. The policy is transparent in scope but raises serious concerns about data minimization, third-party sharing, and international transfers.
Category Assessment
Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.
Collects excessive data, including device identifiers, location, payments, and third-party app data, with no clear demonstration of necessity or proportionality under GDPR.
The policy is detailed but overly broad, with vague descriptions of third-party sharing and processing purposes, making it difficult for users to understand specific data flows.
Data is shared widely with third-party apps, advertisers, vendors, and other Meta companies, often without explicit user consent or clear opt-out mechanisms.
Transfers data from the EEA to the U.S. and other countries using SCCs and consent, but fails to address surveillance risks or provide supplementary measures as required by GDPR.
No explicit mention of whether user data is used for AI/model training, nor any opt-out mechanism for such use, which is a significant gap under GDPR.
Describes rights like access, deletion, and ad controls, but lacks clarity on how to exercise these rights effectively, especially for non-users or data shared with third parties.
Key Findings
Notable clauses, issues, or positive practices discovered (critical first)
Excessive and broad data collection without clear necessity
The policy lists extensive categories of data collected, including 'things you do and provide,' 'things others do and provide,' device information (e.g., GPS, Bluetooth, IP address), payment details, and data from third-party apps and partners. There is no justification for why all this data is strictly necessary for the services provided, violating GDPR’s data minimization principle (Art. 5(1)(c)).
Vague and broad third-party sharing with insufficient controls
Data is shared with 'apps, websites and third-party integrations,' 'vendors, service providers and other partners,' and 'Facebook companies' without naming specific recipients or providing granular opt-outs. The policy states that third-party apps can access users’ Public Profile and friend lists, but does not clarify how users can prevent this sharing. This lacks the specificity required under GDPR Art. 13-14.
International transfers to the U.S. rely on SCCs without addressing surveillance risks
The policy states that EEA data may be transferred to the U.S. and other countries using 'standard contract clauses approved by the European Commission' and user consent. However, it does not address the lack of equivalent protections in the U.S. (e.g., government surveillance under FISA 702) or provide supplementary measures to mitigate these risks, as required by the EDPB’s guidance following Schrems II.
No explicit opt-out for AI/model training use of user data
The policy does not mention whether user data is used to train AI or machine learning models, nor does it provide an opt-out mechanism for such use. This is a significant gap, as GDPR requires explicit consent for such processing if it involves automated decision-making or profiling (Art. 22).
Retention of data for legal or security purposes lacks clarity
The policy states that data may be retained for 'an extended period of time' for legal requests, investigations, or to prevent harm, but does not specify the criteria for retention periods or how users can request deletion of such data. This violates GDPR’s storage limitation principle (Art. 5(1)(e)).
Consent mechanisms are unclear and not granular
The policy relies on user consent for data transfers and some processing activities but does not provide clear, granular consent options. For example, users cannot opt out of data sharing with third-party apps or vendors without deleting their account entirely. GDPR requires consent to be freely given, specific, informed, and unambiguous (Art. 4(11)).
Consumer Takeaway
If you use Facebook, expect your data—including what you post, your location, payments, and even data from other apps—to be collected, analyzed, and shared across Meta’s ecosystem and with third parties globally. You have some control over ads and account deletion, but opting out of data sharing or transfers is not straightforward, and your data may still be retained for legal or security purposes.
Compliance Posture
Non-compliant with GDPR in several critical areas: excessive data collection without clear necessity, vague descriptions of third-party sharing, reliance on consent for international transfers without granular opt-outs, and insufficient detail on AI/model training. The policy also lacks explicit legal bases for all processing activities under GDPR Art. 6, and the use of standard contractual clauses for EEA transfers may not suffice given the Schrems II ruling.
EU Transfers
High risk. Data collected in the EEA is transferred to the U.S. and other countries using standard contractual clauses and user consent. However, the policy does not address the lack of equivalent protections in the U.S. (e.g., FISA 702) or provide safeguards to mitigate surveillance risks, which are required under GDPR following Schrems II. Transfers to third countries are not adequately justified or limited.
Detected Signals
Specific data points and practices identified in the text
Evidence Snippets
Direct quotes from the policy supporting these findings
We collect the content and other information you provide when you use our Services, including when you sign up for an account, create or share, and message or communicate with others. This can include information in or about the content you provide, such as the location of a photo or the date a file was created.
We share information we have about you within the family of companies that are part of Facebook.
Information collected within the European Economic Area (“EEA”) may, for example, be transferred to countries outside of the EEA for the purposes as described in this policy. We utilize standard contract clauses approved by the European Commission, adopt other means under European Union law, and obtain your consent to legitimize data transfers from the EEA to the United States and other countries.
We transfer information to vendors, service providers, and other partners who globally support our business, such as providing technical infrastructure services, analyzing how our Services are used, measuring the effectiveness of ads and services, providing customer service, facilitating payments, or conducting academic research and surveys.
We may access, preserve and share your information in response to a legal request (like a search warrant, court order or subpoena) if we have a good faith belief that the law requires us to do so.
We use all of the information we have about you to show you relevant ads.
Missing or Unclear
- No clear legal basis (e.g., Art. 6 GDPR) for each processing activity
- No granular opt-out for third-party data sharing (e.g., with apps, vendors, or advertisers)
- No explicit confirmation or denial of AI/model training use of user data
- No details on supplementary measures for international transfers to address surveillance risks
- No specific retention periods for data stored for legal or security purposes
- No clear mechanism for non-users to access, rectify, or delete their data
- No explicit mention of data protection impact assessments (DPIAs) for high-risk processing
Questions to Ask
- What specific legal bases (e.g., consent, contract, legitimate interest) justify the collection and processing of each category of data under GDPR?
- Which third-party apps, vendors, or partners receive user data, and what data do they receive? Can you provide a full list?
- How do you ensure that international data transfers to the U.S. comply with GDPR, given the lack of equivalent protections under U.S. law (e.g., FISA 702)? What supplementary measures are in place?
- Is user data used to train AI or machine learning models? If so, what is the legal basis, and how can users opt out?
- What are the specific retention periods for data stored for legal requests, investigations, or security purposes? How can users request deletion of such data?
- How can users prevent their data from being shared with third-party apps, websites, or vendors without deleting their account?
- How do you obtain and document explicit, granular consent for data processing activities, particularly for sensitive data like location or payment information?
- What safeguards are in place to protect non-users’ data (e.g., data uploaded by others or collected from third-party apps)?
Share this analysis
Anyone with this link can view the result above.
Built by DentroChat
100% European AI chat for everyone
Chat with AI, work with files, generate images, and search the web. Data stays in Europe.
Other analysed privacy policies
View allsimplic.com.br
45/100
High privacy riskSimplic’s privacy policy is highly invasive for EU users, collecting excessive personal and financial data, sharing it broadly with third parties (including outside Brazil), and lacking GDPR-specific safeguards or opt-outs for AI/model training.
View report →hotels.com
48/100
High privacy riskHotels.com (Expedia Group) collects an unusually broad range of personal data — including sensitive data, voice recordings, and co-traveler info — shares it widely with advertisers and Expedia Group brands, and uses it for extensive AI purposes with no opt-out, making this a data-hungry policy despite decent transfer safeguards.
View report →policies.tinder.com
48/100
High privacy riskTinder collects a massive amount of highly sensitive personal data—including sexual orientation, biometric face data, and precise location—and shares it widely across Match Group companies and advertising partners, making it a concerning privacy choice despite offering standard EU rights.
View report →trust.grindr.com
40/100
High privacy riskGrindr collects deeply sensitive data—including HIV status, precise geolocation, and biometric information—from a vulnerable community, ships it all to the US with no EU establishment, and reserves the right to keep training AI on it even after you opt out.
View report →