132 Total
32 High severity
78 Medium severity
22 Low severity

Key Facts

What may the admin of an Admin Entity do regarding a user's Administered Account?
The admin of an Admin Entity may access, transfer, control, make changes to, and delete a user's Administered Account and all content and designs associated with it.
What can the admin of an Admin Entity access, transfer, control, make changes to, and delete?
The admin of an Admin Entity may access, transfer, control, make changes to, and delete a user's Administered Account and all content and designs associated with it.
When the 'anyone with link' setting is enabled, what are non-Canva users by default allowed to do?
When the 'anyone with link' setting is enabled, non-Canva users are by default allowed to anonymously access a user's design and view the full names, avatars, cursors, and comments of logged-in users, except for Canva Education subscriptions.
What are non-Canva users allowed to view by default when the 'anyone with link' setting is enabled?
When the 'anyone with link' setting is enabled, non-Canva users are by default allowed to anonymously access a user's design and view the full names, avatars, cursors, and comments of logged-in users, except for Canva Education subscriptions.
Will Canva use User Content of Canva Education for AI training?
Canva will not use User Content of Canva Education for AI training.
Can Canva ensure the security of information transmitted to Canva?
Canva cannot ensure or warrant the security of information transmitted to Canva, nor guarantee that information on the Service may not be accessed, disclosed, altered, or destroyed.
Can Canva guarantee that information on the Service may not be accessed, disclosed, altered, or destroyed?
Canva cannot ensure or warrant the security of information transmitted to Canva, nor guarantee that information on the Service may not be accessed, disclosed, altered, or destroyed.
Does Canva sell student data?
Canva does not sell student data.
Does Canva permit children to sign up for the Service independently?
Canva does not permit children to sign up for the Service independently and states it does not knowingly collect or solicit personal information from children, other than as part of Canva Education.
Does Canva knowingly collect or solicit personal information from children?
Canva does not permit children to sign up for the Service independently and states it does not knowingly collect or solicit personal information from children, other than as part of Canva Education.
Stay ahead of the changes
Track Canva and get the diff the day its terms change.
Summary

This document explains how Canva collects and uses your personal information, including using your content and activity to train its AI and to serve you targeted ads on Canva and other sites. If your account is managed by an organization, that organization's admin can access, change, or delete your account and all its content. Canva Education users receive stronger protections: their content is not used for AI training, their data is not sold, and they are not shown advertising.

Analysis

Canva's Privacy Policy establishes the conditions under which Canva collects, uses, shares, and retains user information. It permits Canva to analyze user activity, content, and media uploads to train its algorithms and AI products via machine learning, while providing users a privacy-controls mechanism to manage that use. The policy authorizes sharing or transfer of user information to third parties in connection with corporate transactions including due diligence, and enables Canva and third-party partners to collect and use data — including cookies and automatically collected data — for targeted advertising on Canva and third-party platforms. It carves out categorical protections for Canva Education users, excluding their content from AI training, prohibiting the sale of student data, barring advertising to students, and restricting child self-registration, while noting that Canva cannot warrant the security of transmitted or stored information.

What this means for you

For most users, Canva may use the content you create and upload, along with your activity data, to train its AI models and to serve personalized advertising across Canva and third-party platforms. Your information may also be shared with third parties if Canva undergoes a merger, acquisition, or similar corporate event. If your account is administered by an organization, that admin holds broad control over your account, content, and settings. To limit how your data is used for AI training, you can manage that preference through the privacy controls page in your privacy settings. Canva Education users — including students — are categorically excluded from AI training data use, student data sales, and advertising.

Institutional Analysis
Stay ahead of the changes

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

8 important changes detected

17 versions captured · Last updated: August 2026

What changed Canva replaced its direct email contact address (privacy@canva.com) with a web-based contact form throughout its Privacy Policy. In an update detected on August 26, 2026, the policy no longer directs users to email privacy@canva.com for data access requests, opt-outs, consent withdrawal, child data concerns, or other privacy-related inquiries. Instead, users are directed to 'contact us here' via a hyperlink to a web form. The practical effect is that all privacy requests now route through a centralized web interface rather than direct email.
Why this matters The updated policy removes the direct email address privacy@canva.com and consolidates all privacy requests—including data access, deletion, opt-outs, and consent withdrawal—through a web-based contact form. The substantive privacy rights and processes remain unchanged; only the submission method has shifted from email to an online form. Users seeking to exercise data rights, opt out of third-party data collection, or report concerns about child data can still do so by contacting Canva through the online form.
View full change record →
What changed Canva updated its privacy policy on August 20, 2026 to revise the 'Other policies' section. The document previously listed 'Cavalry Terms' and other linked policies without additional context. The updated version now includes '[Archive]' and 'Print Marketplace Seller Terms' within the policy reference list. This change reorganizes how Canva surfaces related policy documents to users.
Why this matters The updated privacy policy reorganizes its policy reference section to include '[Archive]' notation and adds 'Print Marketplace Seller Terms' to the list of linked policies. This change clarifies the organization of related policy documents users may encounter but does not materially alter substantive privacy obligations or user rights.
View full change record →

July 29, 2026 low

Canva removed the initial cookie consent messaging that previously appeared on the privacy policy landing page, which had offered users the choice to accept all cookies or manage specific cookie …

View change record →
July 25, 2026 low

Canva's privacy policy footer was updated on July 25, 2026 to add a reference to 'Canva Manual Domain Attestation' in its list of related policy documents. This addition appears in …

View change record →
July 21, 2026 low

Canva's privacy policy was updated on July 21, 2026 to add a reference to an 'Indirect Master Services Agreement' in the list of related policy documents. This is a minor …

View change record →
July 17, 2026 low

Canva's privacy policy was updated in an update detected on July 17, 2026. The change involved modification of a single sentence within the document's navigation or interface elements. The specific …

View change record →
June 11, 2026 low

Canva added a reference to 'SMS Terms' in the footer section of their Privacy Policy on June 11, 2026. Previously, this policy document link did not appear in the footer's …

View change record →
April 20, 2026 low

Canva's Privacy Policy was updated on April 20, 2026. The only detected change in the document is the addition of 'Template library' to the product navigation menu within the policy …

View change record →
Featured, High severity
Featured, Medium severity

Complete Provision Index

Every distinct legal provision identified in this document. Featured provisions appear above with analysis.

132 provisions
12 featured
14 clause types
32 high severity
AI / Automated Decision-Making 1
Disclosure and Transparency Requirements 1
Stay ahead of the changes

Monitoring

Canva has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.

Stay ahead of the changes

Governance Intelligence

Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.

Cross-platform context

See how other platforms handle Admin entity may access and control administered account and similar clauses.

Compare across platforms →
Archival ProvenanceSource & Archival Record
Last Captured August 26, 2026 00:34 UTC
Capture Method Automated scheduled archival capture
Document ID CA-D-000204
Version ID CA-V-006071
SHA-256 95df1957be8349f36e6521af6567318fc594643149a84da04919bf98c47df73b
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Governance Monitoring

Monitor governance changes across the platforms you rely on.

Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.

Start monitoring → Compare plans