Canva's general policy does not apply to children under 13 using its education product; a separate Children's Privacy Policy governs that context, and schools are described as the intermediary responsible for obtaining appropriate consent.
This analysis describes what Canva's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The school-as-intermediary model for child data consent is a common but legally sensitive structure under COPPA, and whether it satisfies verifiable parental consent requirements depends on the specific contractual terms agreed with educational institutions and applicable state student privacy laws.
Interpretive note: Whether the school-as-intermediary consent model satisfies COPPA's verifiable parental consent requirement in all circumstances depends on the specific terms of the institutional agreement, which is not reproduced in the general privacy policy.
The updated privacy policy no longer includes explicit language describing Canva's use of non-essential cookies for personalization, advertising tailoring, and website analytics. Previously, the poli…
The updated privacy policy no longer explicitly discloses optional cookie uses or provides cookie preference controls on the privacy policy page itself. Previously, Canva stated it would use non-esse…
Parents and guardians of children using Canva through school programs should be aware that the general privacy policy does not govern those accounts; the separate Children's Privacy Policy and the school's agreement with Canva determine what data is collected and how it is used. Schools acting as data intermediaries assume responsibility for consent under this structure.
How other platforms handle this
If you are a California resident, you may have certain rights under the California Consumer Privacy Act (CCPA). These rights may include: the right to know about personal information collected, disclosed, or sold; the right to delete personal information collected from you; the right to opt-out of t...
Depending on where you live, you may have certain rights with respect to your personal information. These rights may include: The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which we collected i...
If you are located in the European Economic Area or the United Kingdom, you have certain rights under applicable data protection laws, including the right to access, correct, or delete your personal data, the right to object to or restrict processing, and the right to data portability. You may also ...
Monitoring
Canva has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We have a separate Children's Privacy Policy that applies to our education product. We do not knowingly collect personal information from children under 13 without verifiable parental consent, except as permitted under applicable law in the context of our education product where a school or educational institution acts as the intermediary.— Excerpt from Canva's Canva Privacy Policy
REGULATORY LANDSCAPE: This provision implicates COPPA, which applies to online services directed to children under 13 and requires verifiable parental consent prior to collection of personal information. The school-as-operator model is recognized under COPPA with specific conditions. FERPA applies to student records held by educational institutions. State student privacy laws such as SOPIPA (California) and equivalent statutes in other states may impose additional restrictions on use of student data for advertising or product improvement purposes. GOVERNANCE EXPOSURE: High for education customers. The school-as-intermediary consent structure places significant legal responsibility on educational institutions, and compliance depends on whether the institutional agreement with Canva adequately delineates data use restrictions, prohibits advertising targeting of students, and addresses AI training use of student-generated content. JURISDICTION FLAGS: California's SOPIPA and related student privacy statutes impose specific prohibitions on targeted advertising and sale of student data. New York, Colorado, and other states have enacted similar student privacy legislation. COPPA federal requirements apply nationally. EU education users face GDPR requirements regarding child data processing under Article 8. CONTRACT AND VENDOR IMPLICATIONS: School districts and educational institutions should review their specific agreement with Canva for Education, confirm that a DPA or equivalent data use agreement is in place, and verify that student data is excluded from advertising targeting and AI training use. Procurement teams should assess whether the Children's Privacy Policy and education agreement terms are consistent with district data governance policies. COMPLIANCE CONSIDERATIONS: Education customers should obtain and review Canva's Children's Privacy Policy and the applicable education agreement to confirm data use restrictions. Annual review of third-party vendor data agreements is recommended under many state student privacy frameworks. Institutions should document their review as part of vendor due diligence for student data processors.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The school-as-intermediary model for child data consent is a common but legally sensitive structure under COPPA, and whether it satisfies verifiable parental consent requirements depends on the specific contractual terms agreed with educational institutions and applicable state student privacy laws.
Parents and guardians of children using Canva through school programs should be aware that the general privacy policy does not govern those accounts; the separate Children's Privacy Policy and the school's agreement with Canva determine what data is collected and how it is used. Schools acting as data intermediaries assume responsibility for consent under this structure.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Canva.