California Resident Rights and CCPA Disclosure

What it is

California users have specific legal rights under state law to access, delete, correct, and opt out of sharing of their personal information, and Canva states it will not discriminate against users who exercise these rights.

Why it matters (compliance & governance perspective)

California residents have the most comprehensive set of rights disclosed in this policy, including the ability to stop Canva from sharing their personal information with advertising partners, which is a right not universally available to users in other US states.

This document changed recently

Consumer impact (what this means for users)

If you are a California resident, you can request that Canva show you what personal information it holds about you, delete it, correct it, or stop sharing it with advertising partners, and Canva states it will not penalize you for making these requests. Exercising the opt-out right for data sharing could limit the behavioral advertising you see as a result of Canva's data sharing practices.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision reflects compliance with the California Consumer Privacy Act as amended by the California Privacy Rights Act. Relevant rights include the right to know, right to delete, right to correct, right to opt out of sale or sharing, and right to limit use of sensitive personal information. The California Privacy Protection Agency and the California Attorney General are the primary enforcement authorities. The policy's non-discrimination commitment aligns with CCPA statutory requirements. GOVERNANCE EXPOSURE: Medium. The provision demonstrates formal CCPA and CPRA compliance posture. Key governance risks relate to the operational implementation of these rights, specifically whether requests are fulfilled within the statutory 45-day response window and whether the opt-out mechanism for sharing is technically functional and not undermined by dark patterns in the user interface. JURISDICTION FLAGS: These rights apply exclusively to California residents. Users in other US states may have similar rights under state-specific laws enacted in Virginia, Colorado, Connecticut, Texas, and other states that have passed comprehensive privacy legislation, but these are not addressed in the provision as quoted. Organizations operating in multiple US states should assess whether Canva's disclosed rights framework needs to be supplemented by state-specific mechanisms. CONTRACT AND VENDOR IMPLICATIONS: Business customers using Canva who are themselves CCPA-covered businesses should assess whether they act as a business or service provider in relation to personal information processed through Canva, and whether a service provider agreement is in place that prohibits Canva from using that data for its own advertising purposes. If Canva receives employee or customer data from a business user, the nature of that relationship affects the applicability of consumer rights requests. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Canva's privacy rights request mechanism is accessible without undue burden, that response timelines are documented and monitored, and that the opt-out of sharing mechanism is technically implemented such that downstream advertising partner data flows are actually terminated upon request. Sensitive personal information handling limitations should be audited against the categories disclosed in the policy.

Applicable agencies

Provision details

Other risks in this policy

• Third-Party Advertising and Analytics Data Sharing medium
• AI Feature Content Use for Model Improvement medium
• International Data Transfers via Standard Contractual Clauses medium
• Design Content Access for Safety and Service Improvement medium
• Children Under 13 Data Restriction low
• Cookie and Tracking Technology Use medium