Our updated Data Processing Terms include a reference to our new European Data Transfer Addendum, effective September 27, 2021.

Customer List Custom Audiences Terms


Facebook’s customer list custom audiences feature enables you to create an audience using your data such as email addresses and phone numbers ("Audience"). When using this feature, your data is locally hashed on your system before you upload and pass it to Facebook ("Hashed Data") to be used to create your Audience. Without limiting any agreement between you and Facebook, by clicking “I accept,” passing to Facebook the Hashed Data, or using an Audience for advertising, you agree to the following:
  1. You represent and warrant, without limiting anything in these terms, that you have all necessary rights and permissions and a lawful basis to disclose and use the Hashed Data in compliance with all applicable laws, regulations, and industry guidelines. If you are using a Facebook identifier to create an Audience, you must have obtained the identifier directly from the data subject in compliance with these terms.

  2. If you are providing Hashed Data on behalf of an advertiser, you represent and warrant that you have the authority as agent to the advertiser to disclose and use such data on their behalf and will bind the advertiser to these terms.

  3. You represent and warrant that the Hashed Data does not relate to data about any individual who has exercised an option that you have, directly or indirectly, committed to honoring or provided to opt out of having such data used to create targeting audiences on Facebook. To the extent an individual exercises such an opt-out after you have used data relating to them to create an Audience, you will remove them from the Audience.

  4. You instruct Facebook to use the Hashed Data for the matching process. Facebook will not share the Hashed Data with third parties or other advertisers and will delete the Hashed Data promptly after the match process is complete. Facebook will implement processes and procedures to maintain the confidentiality and security of the Hashed Data and the collection of Facebook User IDs that comprise the Audience(s) created from your Hashed Data (“your Audience(s)”), including by maintaining technical and physical safeguards that are designed to (a) protect the security and integrity of data while it is within Facebook's systems and (b) guard against the accidental or unauthorized access, use, alteration or disclosure of data within Facebook's systems. These processes and procedures include the measures listed in Facebook’s Data Security Terms (as updated from time to time, for example, to reflect technological developments) which are expressly incorporated into these terms.

  5. Facebook will not give access to or information about the Audience(s) to third parties or other advertisers, use your Audience(s) to append to the information we have about our users or build interest-based profiles, or use your Audience(s) except to provide services to you, unless we have your permission or are required to do so by law.

  6. You acknowledge that Facebook offers tools to provide transparency to people about how Facebook advertising works, to explain why people are shown specific ads, and to allow people to control their ads experience. You also acknowledge that Facebook does not disclose to you which individual users comprise your Audience created based on your Hashed Data.

  7. Facebook may modify, suspend or terminate access to, or discontinue the availability of, this feature at any time. You may discontinue your use of Audiences at any time. You may delete your Audience(s) from the Facebook system at any time through your account tools.

  8. You may not use this feature unless you are an advertiser (or an agency acting on behalf of an advertiser), Ads API or Custom Audiences API partner, a data partner uploading an audience on behalf of that advertiser, or have obtained express, written permission from Facebook.

  9. You may not sell or transfer your Audiences, or authorize any third party to sell or transfer Audiences. However, advertisers and their service providers, as well as independent parties you have entered into agreements with for licensing marketing information, can share Audiences with each other through tools we make available for that purpose, subject to the restrictions and requirements of those tools, our terms, and applicable law.

  10. Data Processing Terms:
    1. To the extent Hashed Data contain Personal Information which you Process subject to the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”) or you are in Andorra, Azores, Canary Islands, Channel Islands, French Guiana, Guadeloupe, Isle of Man, Madeira, Martinique, Mayotte, Monaco, Réunion, San Marino, Saint Barthélemy, Saint-Martin, Switzerland, United Kingdom sovereign bases in Cyprus (Akrotiri or Dhekelia), or Vatican City, the parties acknowledge and agree that for purposes of creating your Audience(s), as described above, that you are the Controller in respect of such Personal Information, and you instruct Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland (“Facebook Ireland”) to Process such Personal Information on your behalf as your Processor pursuant to these terms and Facebook’s Data Processing Terms. The Data Processing Terms are expressly incorporated herein by reference and apply between you and Facebook Ireland together with these Customer List Custom Audiences Terms.
    2. In all other cases, the parties acknowledge and agree that for purposes of creating your Audience(s), as described above, that you are the controller in respect of such Personal Information, and you instruct Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA to Process such Personal Information on your behalf as your Processor pursuant to these terms and Facebook’s Data Processing Terms. The Data Processing Terms are expressly incorporated herein by reference and apply between you and Facebook, Inc. together with these Custom Audience Terms.
    3. “Personal Information,” “Controller,” “Processor” and “Processing” in this Section 10 have the meanings set out in the Data Processing Terms.
    4. References to GDPR and its provisions in these terms include the GDPR as amended and incorporated into UK law after the GDPR ceases to apply in the UK.

  11. For US Data Subjects: The parties acknowledge and agree that the State-Specific Terms may apply to the provision and use of this feature and are incorporated into these Customer List Custom Audiences Terms by reference.

  12. These terms and, to the extent applicable, the Data Processing Terms are supplemental to the Commercial Terms and do not replace any other terms applicable to your purchase of advertising inventory from Facebook (including but not limited to the Facebook Advertising Policies and Self-Serve Ads Terms, which will continue to apply. In the event of any conflict between these terms and the Commercial Terms, these terms will govern with respect to your use of this feature and solely to the extent of the conflict. Facebook reserves the right to monitor or audit your compliance with these terms and to update these terms from time to time.

  13. These terms apply to the creation of Audiences as described above. Website Custom Audiences, Mobile App Custom Audiences, and Offline Custom Audiences are subject to the Business Tools Terms. We have updated the Custom Audiences Terms, including changing its name to the Customer List Custom Audiences Terms. For purposes of the Custom Audiences Terms, references in existing terms or agreements to the “your custom audience(s)” will now mean Audience(s).

Effective Date: August 31, 2020