California users have specific legal rights under state law to access, delete, correct, and opt out of sharing of their personal information, and Canva states it will not discriminate against users who exercise these rights.
This analysis describes what Canva's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes California Consumer Privacy Act (CCPA) statutory rights within Canva's terms of service, establishing the procedural mechanism through which residents may submit and have processed data subject access, deletion, correction, and opt-out requests. The clause establishes non-discrimination requirements as a condition of the service.
The updated privacy policy no longer explicitly discloses that Canva uses cookies to personalize ads, analyze website performance, or tailor content on partner sites. Previously, the policy stated these purposes and directed users to the cookie policy for more information and choice. The revised policy now mentions only that essential cookies are used to make Canva work. This change removes transparency about non-essential cookie uses and eliminates the cookie consent interface (Accept all cookies / Manage cookies buttons) that was previously presented in the privacy policy document itself.
View change record →The updated privacy policy no longer includes explicit language describing Canva's use of non-essential cookies for personalization, advertising tailoring, and website analytics. Previously, the policy stated that Canva would use these cookies only if users accepted. The removal of this disclosure means the policy no longer clearly explains these cookie categories or presents a consent interaction for non-essential cookies at the point where this information was previously disclosed. Depending on applicable cookie law and Canva's implementation, users may need to consult additional documentation such as a separate cookie policy to understand how non-essential cookies are managed.
View change record →The updated privacy policy no longer explicitly discloses optional cookie uses or provides cookie preference controls on the privacy policy page itself. Previously, Canva stated it would use non-essential cookies for personalization, ad targeting, and analytics only if users accepted, and offered 'Accept all cookies' and 'Manage cookies' options. The removal of this disclosure and consent mechanism may affect how users understand cookie practices and when consent is obtained. Users who previously accessed cookie preferences through the privacy policy will need to locate these controls elsewhere on the Canva platform if they remain available.
View change record →If you are a California resident, you can request that Canva show you what personal information it holds about you, delete it, correct it, or stop sharing it with advertising partners, and Canva states it will not penalize you for making these requests. Exercising the opt-out right for data sharing could limit the behavioral advertising you see as a result of Canva's data sharing practices.
Cross-platform context
See how other platforms handle California Resident Rights and CCPA Disclosure and similar clauses.
Compare across platforms →Monitoring
Canva has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you are a California resident, you have the right to: know what personal information we collect, use, and disclose about you; delete personal information we have collected from you; correct inaccurate personal information; opt out of the sale or sharing of your personal information; limit use and disclosure of your sensitive personal information; and not be discriminated against for exercising your rights. You can exercise your rights by contacting us at privacy@canva.com or through our privacy rights request form.— Excerpt from Canva's Canva Privacy Policy
REGULATORY LANDSCAPE: This provision reflects compliance with the California Consumer Privacy Act as amended by the California Privacy Rights Act. Relevant rights include the right to know, right to delete, right to correct, right to opt out of sale or sharing, and right to limit use of sensitive personal information. The California Privacy Protection Agency and the California Attorney General are the primary enforcement authorities. The policy's non-discrimination commitment aligns with CCPA statutory requirements. GOVERNANCE EXPOSURE: Medium. The provision demonstrates formal CCPA and CPRA compliance posture. Key governance risks relate to the operational implementation of these rights, specifically whether requests are fulfilled within the statutory 45-day response window and whether the opt-out mechanism for sharing is technically functional and not undermined by dark patterns in the user interface. JURISDICTION FLAGS: These rights apply exclusively to California residents. Users in other US states may have similar rights under state-specific laws enacted in Virginia, Colorado, Connecticut, Texas, and other states that have passed comprehensive privacy legislation, but these are not addressed in the provision as quoted. Organizations operating in multiple US states should assess whether Canva's disclosed rights framework needs to be supplemented by state-specific mechanisms. CONTRACT AND VENDOR IMPLICATIONS: Business customers using Canva who are themselves CCPA-covered businesses should assess whether they act as a business or service provider in relation to personal information processed through Canva, and whether a service provider agreement is in place that prohibits Canva from using that data for its own advertising purposes. If Canva receives employee or customer data from a business user, the nature of that relationship affects the applicability of consumer rights requests. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Canva's privacy rights request mechanism is accessible without undue burden, that response timelines are documented and monitored, and that the opt-out of sharing mechanism is technically implemented such that downstream advertising partner data flows are actually terminated upon request. Sensitive personal information handling limitations should be audited against the categories disclosed in the policy.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision operationalizes California Consumer Privacy Act (CCPA) statutory rights within Canva's terms of service, establishing the procedural mechanism through which residents may submit and have processed data subject access, deletion, correction, and opt-out requests. The clause establishes non-discrimination requirements as a condition of the service.
If you are a California resident, you can request that Canva show you what personal information it holds about you, delete it, correct it, or stop sharing it with advertising partners, and Canva states it will not penalize you for making these requests. Exercising the opt-out right for data sharing could limit the behavioral advertising you see as a result …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Canva.