Developer Data Use Policy

Before you submit your app for review, evaluate your content and processes against this guide to determine if you are on the right track to complying with some key tenets of the DDUP. Check off each requirement once you have confirmed your organization and app meet it.

Please note: This evaluation is not exhaustive, and is not a replacement for reading and understanding the DDUP in full. It does not guarantee compliance with Meta policies, nor applicable data privacy laws. Review Meta's Developer Data Use Policy for a comprehensive overview of Meta's requirements.

Data Collection

Before collecting or processing any data from users, Meta devices, or Meta Horizon...

1. you obtain consent from your users

AND/OR

1. you have a legal basis

1. You have reviewed and confirmed that you ONLY collect data according to what is allowed under the Data You Collect from End Users section of the DDUP

Allowed Data Use

You only use User Data (data from users AND/OR Meta devices) to...

1. run, support, and maintain your app to provide or improve the experience

AND/OR

1. conduct analytics

If you DO conduct analytics, like gathering insights to improve your app, that analytics data is...

1. aggregated, de-identified, or anonymized in a way that does not allow for re-identification

1. You have reviewed and confirmed that you ONLY use User Data (both user data and device data) according to the allowed uses outlined in the Permitted Uses of User Data section of the DDUP

Prohibited Uses

You NEVER use device data for...

1. providing the user with information about the opportunity to get new or existing features or functionality in an app they've purchased from you, or other apps you offer
   Note: You can use Meta Horizon User Data solely for this purpose, as outlined in the Permitted Uses of User Data section of the DDUP

You NEVER keep, use, or disclose User Data for...

1. any purpose other than what is described in the DDUP, the SDK License Agreement, and any other agreement with Meta

You NEVER use User Data...

1. for marketing or advertising purposes other than what is strictly defined in the Permitted Uses of User Data section of the DDUP
3. to profile, discriminate, or encourage discrimination against people based on categories protected by law, regulation, or other Meta terms or policies like race, sex, age, disability, and sexual orientation
5. to perform, facilitate, or provide tools for surveillance including the collection, use, or sharing of information about people, groups, or events for law enforcement, national security, or counter-intelligence without a valid court order
7. to identify a person, including their real name or actual images
9. to combine with any other data, collected by you or a third party other than what is specifically defined under the Permitted Uses of User Data section of the DDUP
11. to attempt to decode, circumvent, re-identify, de-anonymize, unscramble, unencrypt, reverse hash, or reverse engineer User Data provided to you

You NEVER...

1. sell, license, purchase, rent, or lend User Data or similar actions, or permit a third party to do so
3. access or collect User Data, or allow others to collect User Data, using automated means like harvesting bots or scrapers
5. send or submit Device User Data (not Meta Horizon User Data) to Meta using any of Meta's business tools or products, including Ads or Analytics tools or products

1. You have reviewed and confirmed that you do NOT use User Data in any of the ways prohibited under the Prohibited Uses of User Data section of the DDUP

Sharing User Data

You only share User Data with a third party or their sub-providers...

1. after you have obtained consent from your users

AND/OR

1. when you have legal basis

AND/OR

1. you are required under applicable law or regulation

AND/OR

1. when a user directs you to in writing

You ensure that all third-party partners comply with the DDUP and all other terms and policies. Specifically, you have a written agreement with third parties that states they, and their sub-providers...

1. only use User Data to provide the user with the agreed-upon service(s)

AND

1. are prohibited from using User Data in any way that violates the DDUP or any other terms or policies

AND

1. are required to keep User Data secure and confidential

AND

1. have a documented process in place to delete User Data upon request or upon termination of the relationship

If requested by Meta, you are prepared to...

1. share a list of service providers and their sub-service providers, including up-to-date contact information for each, types and volume of User Data shared, and proof of written agreements that demonstrate compliance

1. You have reviewed and confirmed that you ONLY share User Data under the circumstances allowed in the Sharing User Data section of the DDUP

Security

You enforce, and maintain, administrative, physical, and technical safeguards that...

1. meet or exceed industry standards

AND

1. comply with applicable laws and regulations including data security and privacy laws, rules, and regulations

AND

1. are designed to prevent any unauthorized processing of User Data

1. You have reviewed and confirmed you comply with the security requirements outlined in the Security & Deletion section of the DDUP

Looking for more? Check out our Data Security Guide

Incident Notification

If you experience an incident or breach, or have in the past, you are prepared to...

1. use the incident reporting form to report to Meta: what happened, what steps you took to mitigate the incident, and the outcome

AND

1. keep Meta informed about your progress

AND

1. as a best practice, include those same details about the incident in the “Additional Comments” section when submitting a Data Use Checkup to request access to platform features to give a reviewer everything they need in one place

Deletion

You delete User Data without any undue delay when...

1. a user requests their User Data be deleted

AND/OR

1. a user deletes their account, or no longer has an account

AND/OR

1. User Data is no longer necessary to provide the experience or service to your users

AND/OR

1. Meta requests data deletion

AND/OR

1. deletion is required by applicable law or regulations

1. You have reviewed and confirmed you comply with the data deletion requirements outlined in the Security & Deletion section of the DDUP

Privacy

Your Privacy Policy...

1. clearly explains your collection, use, and processing of data
3. does not supersede or modify, and is not less protective than, the DDUP
5. is in effect as long as you are using the Meta Horizon platform
7. is live, publicly available, and up-to-date

1. You have reviewed and confirmed you comply with the privacy policy requirements outlined in the Data You Collect from End Users section of the DDUP

Looking for more? Check out our Privacy Policy Evaluation resource

Reviews & Monitoring

In preparation for review and ongoing monitoring...

1. your list of admins, and their contact information, is up-to-date

Before you submit your app for review...

1. You have read, and you fully understand, the Developer Data Use Policy (DDUP)

Disclaimer: This resource does not guarantee compliance with Meta policies, nor applicable data privacy laws. Review Meta Horizon's Developer Data Use Policy for a comprehensive overview of Meta's requirements.