Adobe Firefly (Creative Cloud) - GDPR & Data Privacy Overview for European Clients

Version: June 2026 - prepared by WAIMAKERS B.V.

1 Purpose

This overview explains how Adobe Firefly generative AI features (available standalone and within Creative Cloud) handle data in relation to GDPR, with a focus on European customers. Adobe Firefly is a commercially safe generative AI platform for creative content creation, offering features like Text to Image, Generative Fill, Generative Expand, and more.

Adobe Inc. (US-based) / Adobe Systems Software Ireland Limited (EU entity) develops and operates Adobe Firefly and Creative Cloud services.

2 Comparison of Adobe Firefly Tiers (EU focus)

Tier	Training on User Data	IP Indemnification	EU Storage	DPA Available	Compliance	Price (approx EUR)
Free Plan	✅ No training	❌ Not included	⚠️ Files in Ireland; AI processing in US	❌ No	Basic	€0/month (limited credits)
Firefly Standard	✅ No training	❌ Not included	⚠️ Files in Ireland; AI processing in US	❌ No	Basic	~€10/month
Creative Cloud Pro	✅ No training	⚠️ Varies by use	⚠️ Files in Ireland; AI processing in US	❌ No (individual)	SOC 2, ISO 27001	~€81/month (restructured 2025; 4,000 generative credits/month)
CC for Teams	✅ No training	✅ Yes (eligible features)	⚠️ Files in Ireland; AI processing in US	✅ Yes	SOC 2, ISO 27001	~€35-85/user/month
CC for Enterprise	✅ No training	✅ Yes (eligible features)	⚠️ Files in Ireland; AI processing in US (custom storage options)	✅ Yes	SOC 2, ISO 27001, HIPAA-ready	Custom pricing

Notes for Europe

No AI training on user content: Adobe's current Firefly FAQ and Generative AI User Guidelines state that Adobe does not train Firefly generative AI models on customer content, user inputs, or generated outputs.[1][2]
EU data storage: Creative Cloud file/asset storage uses AWS data centers in Dublin, Ireland for EU customers, but Adobe's Firefly security fact sheets state that Firefly input content (prompts and uploaded images) is processed, cached, and potentially stored in AWS US-East and US-West data centers regardless of the user's location - i.e. the generative AI processing is documented as US-based, not EU.[3][4]
IP indemnification: Teams and Enterprise customers are eligible for IP indemnification on outputs from eligible Firefly features (Text to Image, Generative Fill, Generative Expand, etc.) when used within approved surfaces.[5][6]
Generative Credits: Adobe uses a consumption-based "Generative Credits" system to meter AI feature usage across all paid plans.[7][8]
Plan restructure (2025): Creative Cloud plans were restructured to CC Pro (~~€81/month, 4,000 generative credits/month) and CC Standard (a new lower tier). The previous single All Apps plan (~~$59.99/month) has been replaced by CC Standard (~~$54.99) and CC Pro (~~$69.99).[9][10]
Partner AI models: Adobe added OpenAI GPT Image, Google Imagen, Google Veo 3, and Flux as partner models available within Creative Cloud. Data handling for these partner models may differ from Firefly; verify with Adobe.
Firefly Foundry: Launched for Enterprise - allows organisations to train and deploy custom Firefly models on their own brand assets.
Content Credentials & training preference: Adobe Content Credentials can express a request that supporting generative AI models not train on or use the content; Adobe currently documents support for this preference in Adobe Firefly and Spawning.
No-training reaffirmed: Adobe states in current terms that user content is not used to train Firefly or partner generative AI models.
EU AI Act Art. 50 labelling: EU AI Act Article 50 transparency obligations are scheduled to apply from 2 August 2026. Adobe Content Credentials can support provenance and labelling workflows, but they are not a complete compliance answer by themselves.

3 Is Adobe Firefly GDPR-Compliant?

Short answer: Adobe Firefly can be operated in a GDPR-supportive way for EU business use, particularly on Teams and Enterprise plans with the right DPA and transfer safeguards. Individual/Free plans lack enterprise-grade contractual protections (DPA) but maintain the same no-training and security practices.

What applies to all plans:

No AI/ML training on user data - Adobe states in current Firefly documentation and Generative AI User Guidelines that customer content, prompts, inputs, and outputs are not used to train Firefly generative AI models.[1][2]
Content Credentials - Users can embed Content Credentials in outputs to signal "Do Not Train" preferences to other AI systems (supported by Adobe Firefly and Spawning).[12]
Responsible training data - Adobe states Firefly models are trained on Adobe Stock images, openly licensed content, and public domain content - not user-generated content.[6][13]
Encryption and security - Data in transit and at rest is encrypted; Adobe maintains SOC 2 Type II and ISO 27001 certifications.[14][15]

What's plan-dependent:

Free / Premium plans: No DPA, no IP indemnification, limited contractual GDPR protections (suitable for personal use, not recommended for processing EU personal data at scale).
Creative Cloud Pro (individual): Includes Firefly features and credits, SOC 2/ISO 27001 compliance, but no formal DPA (borderline for small business use).
Teams / Enterprise plans: Full DPA available, IP indemnification, admin controls, enhanced security features, and potential for custom data residency arrangements.[16][17]

Infrastructure limitations (all plans):

EU storage confirmed - Creative Cloud storage (files, assets) uses AWS Dublin, Ireland data center for EU customers.[3]
Generative processing location: US - Adobe's Firefly security fact sheets state that Firefly input content is processed, cached, and potentially stored in AWS US-East and US-West data centers regardless of the user's location. Document Cloud separately confirms EU/NA/APAC regions, but Firefly generative processing itself is documented as US-based.[4]
No EU-only processing for Firefly - Adobe's published Firefly security fact sheets confirm Firefly input content is processed in AWS US-East/US-West regardless of user location; unlike some competitors (Notion AI, OpenAI) that offer explicit EU data residency for Enterprise, Adobe does not offer EU-only generative processing for Firefly.

What that means in practice:

For personal creative work: Free/Premium plans are fine; no GDPR concerns for non-commercial use.
For small business without personal data: Creative Cloud Pro acceptable if not processing EU personal data.
For business processing EU personal data or requiring contractual safeguards: Use Teams or Enterprise plans with signed DPA and verify data processing locations with Adobe sales.
For highly sensitive data (healthcare, finance): Conduct DPIA; consider Enterprise plan with custom arrangements; confirm HIPAA-ready configurations if needed.[15]

Buyer's note: Adobe Firefly offers strong GDPR protections (no training, DPA for business plans, certifications) but lacks transparency around generative AI processing geography. For EU-regulated workloads, Enterprise customers should request explicit confirmation of processing locations from Adobe.

4 Details by Offering

Free Plan (Firefly Standalone)

Generative Credits: Limited monthly credits (typically 25 generative credits/month).[18]
Data collection: Account data (email, Adobe ID), generation history (prompts, outputs).
Training: No training on user inputs or outputs.[1]
Retention: Generation history stored indefinitely until user manually deletes; no documented auto-purge.[19][20]
Pricing: Free
When to use: Personal experimentation, non-commercial creative projects, learning.
When not to use: Commercial projects requiring IP indemnification; business workflows processing EU personal data; any use case requiring DPA.

Firefly Standard / Pro / Premium (Standalone)

Generative Credits: Standard ~2,000 credits/month; Pro ~7,000 credits/month; Premium ~50,000 credits/month (verify current credit allocations and tier line-up with Adobe).[21][22]
Features: Priority processing, higher resolution outputs, additional features.
Training: No training on user data (same policy as Free).[1]
Retention: Same as Free plan.
Pricing: Standard ~$9.99/month; Pro ~$29.99/month; Premium price not officially published (verify current pricing and tier line-up with Adobe)[22]
When to use: Freelancers and solo creators needing more capacity; still personal/non-commercial focus.
When not to use: Business use requiring legal protections or IP indemnification.

Creative Cloud Pro (Individual)

Includes: Full Creative Cloud apps (Photoshop, Illustrator, Premiere Pro, etc.) with integrated Firefly features (Generative Fill in Photoshop, etc.) plus standalone Firefly access, and access to partner models (OpenAI GPT Image, Google Imagen, Google Veo 3, Flux).[23]
Generative Credits: 4,000 generative credits/month included on CC Pro (plan restructured 2025); overage fees apply.[10]
Important limitation: Individual license; no admin controls, no DPA, no IP indemnification by default.
Compliance: Adobe maintains SOC 2 Type II and ISO 27001 for infrastructure, but contractual protections limited.[14]
Pricing: ~€81/month (CC Pro, restructured 2025; verify current pricing with Adobe)[9]
When to use: Professional creatives not processing EU personal data; small businesses with low compliance requirements.
When not to use: Any business workflow requiring DPA, IP indemnification, or processing EU personal data at scale.

Creative Cloud for Teams

Includes: Same apps as Pro, plus admin console, centralised billing, license management, deployment tools.[23]
IP Indemnification: Available for eligible Firefly features when used in approved contexts.[5][24]
DPA: Data Processing Agreement available upon request.[16]
Admin controls: Manage users, track usage, enforce policies.
Pricing: Varies by app bundle; typically €35-85/user/month depending on configuration[23]
When to use: Small to mid-size teams requiring business-grade legal protections; agencies; marketing departments.
When not to use: When explicit EU-only processing is mandatory (verify with Adobe).

Creative Cloud for Enterprise

Includes: Everything in Teams, plus:
- Custom data residency options (coordinate with Adobe)
- Enhanced security features
- Advanced admin controls
- Dedicated support
- HIPAA-ready configurations available
- Custom Model training via Firefly Foundry (train and deploy custom models on your brand assets)[25]
- Access to partner AI models (OpenAI GPT Image, Google Imagen, Google Veo 3, Flux)
- Content Credentials training/usage preference for supporting models
IP Indemnification: Full coverage for eligible Firefly features.[24]
DPA & Standard Contractual Clauses: Available; for cross-border transfers, rely on Adobe's current DPA/SCCs and any applicable adequacy framework rather than the obsolete EU-U.S. Privacy Shield.[17]
Compliance: SOC 2 Type II, ISO 27001, HIPAA-ready configurations, and GDPR-supportive contractual terms when an appropriate DPA is in place.[15][14]
EU AI Act: From 2 August 2026, Article 50 transparency obligations apply to certain AI-generated or manipulated content. Adobe's Content Credentials can support provenance and labelling workflows, but deployers still need their own Article 50 assessment.
Pricing: Custom pricing; contact Adobe sales
When to use: Enterprises processing EU personal data; regulated industries (healthcare, finance); organisations requiring contractual guarantees and custom configurations.
When not to use: Small teams without budget for enterprise licensing.

5 Data Processing Flow

[User creates prompt in Firefly (Text to Image, Generative Fill, etc.)]
  ↓
[Prompt + input images sent to Adobe infrastructure]
  ├─ CC file/asset storage: Creative Cloud Storage (AWS Dublin for EU users)
  ├─ Input handling: prompt + uploaded images processed/cached in AWS US-East/US-West (regardless of user location; reference content deleted 24h after creation)
  │   ├─ Teams/Enterprise: DPA applies, no training on data
  │   └─ Free/Premium/Pro: No training on data, no DPA
  └─ Output generated and returned to user
       ↓
[Generation history stored in user account]
  ├─ User can view, download, or manually delete
  ├─ No documented automatic purge policy
  └─ Content Credentials optionally embedded ("Do Not Train" flag)

*Note: Adobe does NOT use prompts, inputs, or outputs to train Firefly.*
*CC file/asset storage in EU (Ireland) confirmed; Firefly input content is processed in the US (AWS US-East/US-West) per Adobe's Firefly security fact sheet, regardless of user location.*

6 Recommendations (GDPR-first)

For personal creative work, any tier works - Free/Premium/Pro plans are suitable; no GDPR concerns.
For freelancers and small businesses not processing personal data, Creative Cloud Pro offers best value with full app suite and Firefly integration.
For agencies, marketing teams, and SMEs processing EU personal data, prefer Creative Cloud for Teams with signed DPA and IP indemnification.
For enterprises and regulated industries, use Creative Cloud for Enterprise and conduct a DPIA before processing sensitive personal data; request explicit confirmation of generative AI processing locations from Adobe.
Do not use Free or Premium standalone plans for commercial work requiring IP protection or legal safeguards.
Consider alternatives (Midjourney, Stable Diffusion, or open-source models with self-hosting) if explicit EU-only processing is a hard requirement - Adobe's Firefly security fact sheet confirms Firefly input content is processed in the US (AWS US-East/US-West) regardless of location, so there is no EU-residency option for Firefly generative processing.

7 EU Rollout Checklist (Practical)

Choose the right tier - Teams or Enterprise if processing EU personal data; Pro acceptable for solo creative work without personal data.
Request and sign DPA - For Teams/Enterprise customers, obtain Data Processing Agreement from Adobe (available via account team or support).[16]
Verify data processing locations - Contact Adobe sales to confirm where Firefly generative processing occurs for your account (AWS/Azure regions); request EU-specific processing if required.
Configure admin controls - For Teams/Enterprise, set up admin console, manage user access, enforce security policies.
Conduct DPIA if needed - For high-risk processing (sensitive personal data, large scale), complete Data Protection Impact Assessment per GDPR Article 35.
Train users on acceptable use - Educate team on Adobe Generative AI User Guidelines; remind users not to input sensitive personal data unnecessarily.[1]
Enable Content Credentials - Use Content Credentials to embed "Do Not Train" preferences in outputs if redistributing creative work.[12]
Monitor generative credit usage - Track consumption via admin console (Teams/Enterprise) to manage costs and ensure compliance with usage policies.[18]
Review IP indemnification scope - Understand which Firefly features and export contexts are covered by Adobe's IP indemnification (see Product Description).[5]
Document vendor relationship - Maintain records of DPA, processing locations, and compliance certifications (SOC 2, ISO 27001) for audit purposes.

8 Procurement Quick Answers (EU)

Does Adobe train AI models on our creative work?

Adobe says no. Adobe's "No AI/ML Training" policy says user inputs, prompts, and outputs are not used to train Firefly generative AI models.[1][2] Adobe states Firefly is trained on Adobe Stock, licensed content, and public domain material.

What is Adobe's EU data residency offering?

Adobe Creative Cloud file/asset storage uses AWS data centers in Dublin, Ireland for EU customers.[3] However, Adobe's Firefly security fact sheet documents that Firefly input content (prompts and uploaded images) is processed, cached, and potentially stored in AWS US-East/US-West regardless of the user's location. Document Cloud offers explicit EU/NA/APAC region options,[4] but Firefly generative processing itself is US-based with no EU-residency option - a US data transfer for EU customers that must be covered by SCCs and a transfer impact assessment. Enterprise customers should request written confirmation from Adobe sales.

Do we need a Data Processing Agreement (DPA)?

Yes, if you are processing EU personal data using Firefly (e.g., generating images of identifiable people, processing customer data). DPAs are available for Teams and Enterprise customers.[16][17] Free, Premium, and individual Pro plans do not include DPAs.

What compliance certifications does Adobe hold?

Adobe maintains SOC 2 Type II and ISO 27001 certifications.[14] HIPAA-ready configurations are available for Enterprise customers.[15] Adobe is committed to GDPR compliance and offers Standard Contractual Clauses for data transfers.[17]

What is IP indemnification and do we get it?

IP indemnification means Adobe will defend you if a third party claims your Firefly-generated content infringes their intellectual property. This is available for Teams and Enterprise customers using eligible Firefly features (Text to Image, Generative Fill, Generative Expand, etc.) within approved surfaces.[5][24] Free, Premium, and individual Pro plans are not covered.

How long does Adobe retain our generation history?

Generation history (prompts and outputs) is stored in your Adobe account until you manually delete it.[19][20] Adobe has not published a general auto-purge for generation history, though its Firefly security fact sheet states that reference content uploaded for inference (e.g. Generative Fill/Expand inputs) is deleted 24 hours after creation. Users can bulk-delete generation history via the Firefly web interface.

What happens if we exceed our generative credits?

You can purchase additional credits or upgrade your plan. Overage pricing varies by plan.[7][8] Enterprise customers can negotiate custom credit allocations.

Can we use Firefly outputs commercially?

Yes, with the right license. Teams and Enterprise customers with IP indemnification can use outputs commercially with confidence.[24] Free and Premium users should review Adobe's General Terms of Use for commercial use restrictions.

9 Notes & Caveats

Generative processing location: US: Adobe documents in its Firefly security fact sheet that Firefly input content is processed, cached, and potentially stored in AWS US-East/US-West regardless of the user's location. This is a US data transfer for EU customers (Chapter V GDPR - SCCs + transfer impact assessment) and a blocker for organisations with strict EU-only processing requirements. Enterprise customers should request written confirmation.
No zero-retention option for history: Unlike some competitors (OpenAI, Anthropic offer zero-retention for Enterprise), Adobe stores generation history until manual deletion (no ZDR/ephemeral mode for history). Note Adobe does auto-delete uploaded reference content 24 hours after inference.
Generative Credits complexity: Adobe's consumption model can be confusing - different features consume different credit amounts, and Enterprise negotiations may include custom credit pools. Budget accordingly.
Beta features excluded from IP indemnification: Only generally available (GA) Firefly features qualify for IP indemnification. Beta features (e.g., new models) are explicitly excluded until GA.[5]
Third-party model integration: Adobe has integrated partner models (OpenAI GPT Image, Google Imagen, Google Veo 3, Flux) into Creative Cloud.[26] Data handling for partner models may differ from Firefly's own processing; verify terms with Adobe. Treat Content Credentials as a training/usage preference that works only where the relevant model or system supports it.
Firefly Foundry: Enterprise customers can now train custom models on their brand assets using Firefly Foundry. Custom model data handling requires separate review.
EU AI Act Art. 50 compliance: From 2 August 2026, Article 50 transparency obligations apply to certain AI-generated or manipulated content. Adobe's Content Credentials can support provenance and labelling workflows, but organisations should document their own Article 50 process.
Plan restructure: CC Pro (~€81/month, 4,000 credits) and CC Standard (new lower tier) are the primary individual plans. Verify current pricing with Adobe before purchasing.

10 Disclaimer

This overview is intended solely as an informative tool. We strongly advise customers to thoroughly review all Data Processing Agreements (DPAs) and privacy documentation before deploying Adobe Firefly in production environments - especially when images of identifiable individuals, proprietary designs, or confidential information are processed. WAIMAKERS applies this same principle internally; all tools we use have been thoroughly assessed and included in our own privacy and security documentation. Customers should always carefully evaluate the official documentation, terms, and DPAs of each AI provider they use. WAIMAKERS cannot be held legally liable for the accuracy, currency, or completeness of the information in this document; the ultimate responsibility for GDPR compliance rests with the customer.

Prepared and issued by WAIMAKERS B.V. - June 2026.

References

https://helpx.adobe.com/ie/firefly/web/get-started/learn-the-basics/adobe-firefly-faq.html - Adobe Firefly FAQ
https://adobe.com/legal/licenses-terms/adobe-gen-ai-user-guidelines.html - Adobe Generative AI User Guidelines (No AI/ML Training Policy)
https://wwwimages2.adobe.com/content/dam/cc/en/legal/servicetou/adobe-generative-ai-product-specific-terms-en-us-20250617.pdf - Adobe Generative AI Product Specific Terms
https://helpx.adobe.com/africa/legal/product-descriptions/adobe-firefly.html - Adobe Firefly IP Indemnification Product Description
https://business.adobe.com/in/products/firefly-business/firefly-ai-approach.html - Adobe Firefly Business Approach
https://www.adobe.com/acrobat/business/trust-center/general-data-protection-regulation.html - Adobe Document Cloud and GDPR
https://helpx.adobe.com/sign/admin/assets/gdpr-overview.html - Adobe GDPR Compliance Requirements

Disclaimer

This overview is intended solely as an informative tool. We strongly advise customers to thoroughly review all Data Processing Agreements (DPAs) and privacy documentation before deploying Adobe Firefly in production environments - especially when personal data or proprietary creative content are processed. WAIMAKERS applies this same principle internally; all tools we use have been thoroughly assessed and included in our own privacy and security documentation. Customers should always carefully evaluate the official documentation, terms, and DPAs of each AI provider they use. WAIMAKERS cannot be held legally liable for any mistakes, errors, inaccuracies, or for the accuracy, currency, or completeness of the information in this document; the ultimate responsibility for GDPR compliance rests with the customer.

Prepared and issued by WAIMAKERS B.V. - June 2026.

Adobe Firefly (Creative Cloud)

Need help navigating AI?

Adobe Firefly (Creative Cloud)

Need help navigating AI?