Subject Access Request to Facebook

For someone in the United Kingdom the controller is Meta Platforms, Inc., not a British or an Irish company. Meta's privacy policy says: "The data controller responsible for your information is Meta Platforms, Inc., which you can contact online, or by writing to: Meta Platforms, Inc., ATTN: Privacy Operations, 1 Meta Way, Menlo Park, CA 94025, USA." The same policy names the Information Commissioner's Office as the regulator you can complain to, which is how you can tell it is the version written for the UK. Meta Platforms Ireland Limited holds a separate UK data protection registration and is not the controller here. The sentence introducing the address is scoped to "questions, complaints or requests regarding your information", so it is a route for requests and not only a company identity. Meta's own rights portal will not take this request. Its Privacy rights requests portal at help.meta.com/support/privacy is where both the "contact online" and "Data Protection Officer" links in the privacy policy end up. Choose Facebook, with the location set to United Kingdom, and it offers two things: "Fix a login problem" and "Report a photo or video that violates your privacy". Choose Instagram or Threads instead — the same company, the same privacy policy, the same postal address — and the portal offers "How can I access and/or export my information?". So the option exists across Meta's products and the Facebook branch does not have it. The Facebook branch also lacks the "Create a case" link every other branch ends with. So the route is a letter, and our free letter generator will write it. Post it to the Menlo Park address above. Meta publishes no email address for privacy requests anywhere on its own pages, and no telephone route. The address dpowallc@meta.com appears on Meta Platforms Inc's entry in the ICO register as the data protection officer's contact; Meta does not offer it as a way of making a request, which is why it is not printed as the route above. Downloading your information is not a subject access request. Meta's Download your information tool and its Access your information summary are free, immediate and need you signed in, and Meta describes what they miss: "We store different categories of information for different time periods, so you may not find all information from the time you joined Facebook. You won't find information or content that you deleted because we delete that content from our servers." The export covers your activity, personal information, connections, logged information such as search history, security and login information, and apps and websites off Facebook. Meta also says the download itself expires: "Once your copy has been created, it will be available for download for a few days." If the export is not enough, do both — take it first, then ask in writing for the rest, and say which categories you mean. Meta publishes no response time for a data request. The one month you are entitled to comes from the law, not from a promise Meta has made. Meta asks for no identity documents either, because it publishes no request process to attach them to. Instagram and Messenger are the same request. The privacy policy says "Our Products include Facebook, Instagram, Messenger and AI at Meta", and the controller, the postal address and the complaint route above are the same for all of them. WhatsApp is not: it has its own privacy policy, which says "If you live in the UK, WhatsApp LLC provides the Services to you under this Terms of Service and Privacy Policy", and its own registration. A request about someone who has died is not a subject access request, because the right of access ends at death. Meta's route for that is its Managing a Deceased Person's Account help section, which covers memorialising or removing the profile. Meta says "Memorialized accounts are a place for friends and family to gather and share memories after a person has passed away", and separately that "No one can log into a memorialized account." If a reply arrives and you cannot tell whether it is complete, our free response checker will show you what is missing.

Made under UK GDPR Article 15

Any organisation that decides how and why your personal data is used is a data controller, and must respond to a subject access request. That covers retailers, employers, membership bodies, landlords, charities, gyms and online services alike.

The organisation must confirm whether it is processing your data, provide a copy of it, and explain why it holds it, who it shares it with and how long it keeps it. There is normally no fee.

• All personal data held about you
• Correspondence and internal notes referring to you
• Account, order or membership history
• Call recordings and chat transcripts
• Marketing preferences and consent records

Deadline. An organisation must respond without undue delay and within one month. It may extend by up to two further months where the request is complex or you have made a number of requests, but it must tell you within the first month that it is doing so, and why.

Cost. There is normally no fee. A reasonable fee may only be charged where a request is manifestly unfounded or excessive, or where you ask for further copies.

Proving who you are. An organisation may ask you to verify your identity, but only where it has reasonable doubts about who you are, and it should ask for the minimum needed. Where it needs further information to deal with your request, the one-month clock pauses until you provide it.

How hard they have to look. An organisation has to carry out a reasonable and proportionate search — not an exhaustive one. What counts as reasonable depends on the volume of information, the difficulty of locating it, and the size and resources of the organisation. This is a common reason for a partial response, and it is worth being specific about what you want.

If they ignore you. Complain to the organisation first. Since 19 June 2026 every organisation has had a legal duty to give you a clear way to raise a data protection complaint, to acknowledge it within 30 days, to look into it properly and to tell you the outcome. If it does not, or the answer is incomplete, you can then complain to the Information Commissioner's Office.