When you use Canva's AI tools (such as Magic Write or AI image generators), the prompts and content you type or upload may be used by Canva to train and improve its AI systems, and may be reviewed by Canva employees or automated systems.
This analysis describes what Canva's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational scope of data collection and processing tied to AI feature usage. It clarifies that content inputs to AI features are subject to collection and review processes distinct from standard service operation, with specified purposes that include model development and safety review.
Interpretive note: The precise scope of what content is retained for AI training versus used only for immediate service delivery is not fully specified in the policy, creating some ambiguity about the extent of this practice.
The updated privacy policy no longer explicitly discloses that Canva uses cookies to personalize ads, analyze website performance, or tailor content on partner sites. Previously, the policy stated these purposes and directed users to the cookie policy for more information and choice. The revised policy now mentions only that essential cookies are used to make Canva work. This change removes transparency about non-essential cookie uses and eliminates the cookie consent interface (Accept all cookies / Manage cookies buttons) that was previously presented in the privacy policy document itself.
View change record →The updated privacy policy no longer includes explicit language describing Canva's use of non-essential cookies for personalization, advertising tailoring, and website analytics. Previously, the policy stated that Canva would use these cookies only if users accepted. The removal of this disclosure means the policy no longer clearly explains these cookie categories or presents a consent interaction for non-essential cookies at the point where this information was previously disclosed. Depending on applicable cookie law and Canva's implementation, users may need to consult additional documentation such as a separate cookie policy to understand how non-essential cookies are managed.
View change record →The updated privacy policy no longer explicitly discloses optional cookie uses or provides cookie preference controls on the privacy policy page itself. Previously, Canva stated it would use non-essential cookies for personalization, ad targeting, and analytics only if users accepted, and offered 'Accept all cookies' and 'Manage cookies' options. The removal of this disclosure and consent mechanism may affect how users understand cookie practices and when consent is obtained. Users who previously accessed cookie preferences through the privacy policy will need to locate these controls elsewhere on the Canva platform if they remain available.
View change record →If you use Canva's AI-powered features, the prompts and creative inputs you provide may be used to train Canva's AI models and could be reviewed by Canva staff or automated systems, meaning content you consider private within a design session may be retained for broader product development purposes. Users who want to limit this should consider what information they include in AI prompts.
How other platforms handle this
Google uses this data to provide, improve, and develop Google products, services, and machine-learning technologies, including Google's enterprise products.
engage in any of the foregoing in connection with any use, creation, development, modification, prompting, fine-tuning, training, testing, benchmarking or validation of any artificial intelligence or machine learning tool, model, system, algorithm, product or other technology ("AI Tool").
We may use machine learning and other artificial intelligence (AI) technologies ("AI Technologies") to provide and improve our Service. For example, we may use such AI Technologies to analyze and process your contributions and interactions to provide you with personalized experiences, content recomm...
Monitoring
Canva has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When you use AI-powered features within the Service, we may collect and use the content you input into these features, including text prompts, images, and other materials, to provide, improve, and develop our AI models and services. We take steps to protect your information in this context, but inputs to AI features may be reviewed by Canva staff or automated systems for safety, quality, and improvement purposes.— Excerpt from Canva's Canva Privacy Policy
REGULATORY LANDSCAPE: This provision implicates GDPR Article 6 (lawful basis for processing input data for AI training), Article 13 (transparency obligations about purposes at point of collection), and potentially Article 22 (automated decision-making with significant effects if AI outputs influence user experiences in material ways). It also engages the EU AI Act's requirements for transparency around AI systems, CCPA and CPRA provisions regarding the use of personal information for purposes beyond the original transaction, and FTC guidance on AI transparency and consumer protection. Relevant enforcement authorities include EU supervisory authorities and the FTC. GOVERNANCE EXPOSURE: Medium to High. The use of user-generated creative content to train AI models raises questions about adequacy of disclosure and whether the stated legitimate interest or consent basis is sufficiently robust under GDPR. The practice of human review of AI inputs for safety purposes, while operationally common, should be disclosed clearly to users who may submit sensitive content. JURISDICTION FLAGS: EU and UK users are entitled under GDPR to be informed at the point of collection about all processing purposes including AI training use. If AI training is not disclosed in a sufficiently specific manner in the cookie banner or at the point of AI feature engagement, this may constitute incomplete transparency under GDPR Article 13. California users may have rights to opt out of use of their personal information for AI training if that use constitutes a secondary purpose under CPRA. CONTRACT AND VENDOR IMPLICATIONS: Enterprise and business customers whose employees use Canva's AI features should assess whether employee-generated content submitted to AI tools constitutes personal data processed on their behalf, and whether Canva's data processing agreement covers AI training use as a permitted sub-processing activity or whether it represents an independent controller purpose. COMPLIANCE CONSIDERATIONS: Legal and compliance teams should evaluate whether Canva's in-product disclosures at the point of AI feature engagement adequately inform users that their inputs may be used for AI model training, and whether any opt-out mechanism is offered for this secondary use. Data protection impact assessments may be warranted for high-volume enterprise deployments where sensitive content could be submitted to AI features.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
How Meta, TikTok, and Supabase restructured governance language across documents, jurisdictions, and consent frameworks through incremental document updates.
How 10 AI platforms describe the use of user data for model training, improvement, and development, based on archived governance provisions.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the operational scope of data collection and processing tied to AI feature usage. It clarifies that content inputs to AI features are subject to collection and review processes distinct from standard service operation, with specified purposes that include model development and safety review.
If you use Canva's AI-powered features, the prompts and creative inputs you provide may be used to train Canva's AI models and could be reviewed by Canva staff or automated systems, meaning content you consider private within a design session may be retained for broader product development purposes. Users who want to limit this should consider what information they include …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Canva.