Information for people who don’t use Meta Products
We process your name, mobile phone number and/or your email address if we receive it from our users through the contact uploading or contact syncing feature available on Facebook, Messenger or Instagram (“Contact Uploading”). We process this information even if you are not a user of Facebook, Messenger or Instagram and/or don’t have an account with us (a “Non-User”).
Meta Platforms Ireland Limited is the controller of this information if you're a Non-user living in the European region. If you’re a Non-user living in the United Kingdom (“UK”), Meta Platforms, Inc. is the controller of this information.
References in this Notice to "we", "us" or "our", should be interpreted to mean the relevant Meta Platforms entity (i.e. Meta Platforms Ireland Limited or Meta Platforms, Inc., as applicable) identified above as the controller of your information.
About Contact Uploading and how it works
When a user uses Contact Uploading and grants us access to their device’s address book. We will access and upload the names, phone numbers and email addresses in their address book on a daily basis to our servers, including those of both users of Facebook, Messenger and/or Instagram and other contacts who are not users or don’t have an account (i.e., Non-Users).
What information is collected about Non-Users?
We collect the name, mobile phone number and/or email address of a user's contacts.
How do we use a Non-User’s information?
Contact Uploading is an optional feature where users can choose to upload their device's address book to Facebook, Messenger and/or Instagram. We process the names, phone numbers and/or e-mail addresses in the address book to see if any of the numbers or email addresses belong to users. If a user’s contact is also on Facebook, Messenger and/or Instagram, we can suggest this contact on Facebook as someone to send a friend request to in the Facebook user’s People You May Know or as a suggested account to follow on Instagram. Users can also invite Non-Users to join as users of Facebook, Messenger and/or Instagram via text or email.
Contact Uploading also allows us to suggest a Non-User who joins as a user of Facebook as a friend to add for the user through People You May Know or as a suggested account to follow on Instagram.
Finally, we will also use the address books uploaded to investigate suspicious activity on the Meta Products and keep our platform safe and secure. We also conduct business intelligence and analytics using the address books uploaded to accurately count people and users of the Meta Company Products.
Meta shares information we collect, infrastructure, systems and technology with the other Meta Companies. We share Non-Users’ data with other Meta Companies to be able to provide Contact Uploading and for the purposes set out above.
We retain Non-User’s personal information for as long as needed to provide the Contact Uploading feature to users and for the purposes described above. In certain cases, we need to keep your contact information for longer, including after you ask us to erase it. This includes for legal reasons such as to respond to a legal request or comply with applicable law, for regulatory or litigation matters, to prevent harm or for safety, security and integrity purposes. The length of time we need to keep it will depend on the specific reason.
What is our lawful basis for processing?
We rely on our legitimate interests and the legitimate interests of our users to process the names, phone numbers and/or email addresses of Non-Users for the purposes described above. More specifically, we rely on our interests in operating and providing features of the Facebook, Messenger and/or Instagram to our users, and keeping the Meta Products safe and secure, alongside the interests of our users in more efficiently connecting with their contacts who use Facebook, Messenger and/or Instagram.
How Non-Users exercise their data subject rights
Under applicable data protection law, Non-Users have the right to access, rectify, port, and erase their information, as well as the right to restrict and object to certain processing of their personal information (“Data Subject Rights”).
This includes the right to object to our processing of their information where we are pursuing our legitimate interests or those of a third party. We will consider several factors when assessing an objection from a Non-User including: their reasonable expectations; the benefits and risks to them, us, other users, and third parties; and other available means to achieve the same purpose that may be less invasive and do not require disproportionate effort. The objection will be upheld, and we will cease processing their personal information, unless the processing is based on compelling legitimate grounds or is needed for legal reasons.
We hope that we can satisfy any queries a Non-User may have about the way in which we process their personal information. However, if a Non-User has unresolved concerns they also have the right to complain to Meta Ireland Ltd.’s lead supervisory authority, the Irish Data Protection Commission, under the GDPR, or any other competent data protection supervisory authority. For Meta Platforms, Inc., the UK Information Commissioner’s Office is the competent supervisory authority.
Click here if you have a question about the rights you may have.
Transferring information as part of our global operations
Non-Users’ information will be transferred or transmitted to, or stored and processed in, the United States or other third countries outside of where they live for the purposes described in this Data Notice.
Meta uses Meta’s global infrastructure and data centres, including in the United States.
When Non-Users’ information controlled by Meta Platforms Ireland, Ltd. is transferred or transmitted to, or stored and processed outside of the European Economic Area, Meta Ireland Ltd. relies on appropriate mechanisms for international transfers. For example:
- We rely on decisions from the European Commission by which they recognise that certain countries and territories outside of the European Economic Area ensure an adequate level of protection for personal data. These decisions are referred to as “adequacy decisions.” We transfer Non-Users’ information from the European Economic Area to Argentina, Israel, New Zealand, Switzerland and, where the decision is applicable, Canada in reliance on an adequacy decision.
- In other circumstances, we rely on standard contractual clauses approved by the European Commission or on derogations provided for under applicable law to transfer information to a third country. For example, we rely on standard contractual clauses when transferring data to Meta Platforms, Inc. In addition to the standard contractual clauses, we also apply supplemental measures to ensure equivalent protection of your data when transferred.
When Non-users’ information controlled by Meta Platforms, Inc. is transferred or transmitted to, or stored and processed outside the UK, Meta Platforms, Inc. relies on appropriate mechanisms for international data transfers. For example:
- We rely on relevant “adequacy regulations” from the UK Government by which they recognise that certain countries and territories outside of the UK ensure an adequate level of protection for personal data.
- In other circumstances, we use the UK standard contractual transfer mechanisms approved by the UK Parliament (the International Data Transfer Agreement and, the International Data Transfer Addendum) or rely on derogations provided for under applicable law to transfer information to a third country. In addition to the UK standard contractual transfer mechanisms, we also apply supplemental measures to ensure equivalent protection of your data when transferred.
If you have questions about Meta's data transfers and the standard contractual clauses or transfer mechanisms, you can contact us.
Contact us
If you have questions about this notice, you can write to us at the following address:
For Meta Platforms Ireland Limited
FAO: Privacy operations
Merrion Road
Dublin 4
D04 X2K5
Ireland
If you wish to contact the Data Protection Officer for Meta Ireland Ltd., please use this contact form.
For Meta Platforms, Inc.
FAO: Privacy Operations
1601 Willow Road
Menlo Park, CA 94025, USA
If you are in the UK and wish to contact the Data Protection Officer for Meta Platforms, Inc., please use this contact form.
