Canva uses cookies for both essential platform functions and optional purposes including advertising targeting and analytics. Non-essential cookies can be managed through a cookie settings tool.
This analysis describes what Canva's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy distinguishes between essential and optional cookies, and the availability of a cookie settings tool is relevant to GDPR and ePrivacy consent obligations for EU users. The practical adequacy of consent obtained through the cookie banner cannot be assessed from policy text alone.
Interpretive note: Whether Canva's cookie consent mechanism satisfies GDPR and ePrivacy prior consent requirements cannot be assessed from policy text alone; operational implementation of the consent banner requires separate verification.
The updated privacy policy no longer explicitly discloses that Canva uses cookies to personalize ads, analyze website performance, or tailor content on partner sites. Previously, the policy stated these purposes and directed users to the cookie policy for more information and choice. The revised policy now mentions only that essential cookies are used to make Canva work. This change removes transparency about non-essential cookie uses and eliminates the cookie consent interface (Accept all cookies / Manage cookies buttons) that was previously presented in the privacy policy document itself.
View change record →The updated privacy policy no longer includes explicit language describing Canva's use of non-essential cookies for personalization, advertising tailoring, and website analytics. Previously, the policy stated that Canva would use these cookies only if users accepted. The removal of this disclosure means the policy no longer clearly explains these cookie categories or presents a consent interaction for non-essential cookies at the point where this information was previously disclosed. Depending on applicable cookie law and Canva's implementation, users may need to consult additional documentation such as a separate cookie policy to understand how non-essential cookies are managed.
View change record →The updated privacy policy no longer explicitly discloses optional cookie uses or provides cookie preference controls on the privacy policy page itself. Previously, Canva stated it would use non-essential cookies for personalization, ad targeting, and analytics only if users accepted, and offered 'Accept all cookies' and 'Manage cookies' options. The removal of this disclosure and consent mechanism may affect how users understand cookie practices and when consent is obtained. Users who previously accessed cookie preferences through the privacy policy will need to locate these controls elsewhere on the Canva platform if they remain available.
View change record →Canva's policy states that advertising and analytics cookies are optional and can be managed through a cookie preferences tool. Users who do not adjust their settings may have browsing and usage behavior tracked across Canva and potentially on partner sites for advertising purposes.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We may display advertisements on our Services and those advertisements may be targeted to your interests based on your personal information. We may share your personal information with advertising partners for interest-based advertising purposes. You may opt out of interest-based advertising by visi...
Monitoring
Canva has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We use cookies and similar tracking technologies to collect information about your use of the Service. This includes essential cookies needed for the Service to function, as well as optional cookies used for analytics, advertising, and personalisation purposes. You can manage your cookie preferences through our cookie settings tool.— Excerpt from Canva's Canva Privacy Policy
REGULATORY LANDSCAPE: This provision implicates the EU ePrivacy Directive and GDPR Article 6 for EU users, requiring prior informed consent for non-essential cookies. The UK equivalent is the Privacy and Electronic Communications Regulations (PECR). The FTC Act applies for US users in the context of disclosed cookie practices. CCPA and CPRA are relevant for California users where cookie-based behavioral data constitutes 'sharing' for advertising purposes. GOVERNANCE EXPOSURE: Medium. Cookie consent compliance is a well-documented compliance area with active regulatory enforcement in the EU. The critical question is whether Canva's cookie consent mechanism meets the GDPR standard of freely given, specific, informed, and unambiguous consent, including whether pre-ticked boxes or default opt-in settings are used for non-essential cookies. JURISDICTION FLAGS: EU and EEA users are subject to the most stringent requirements under GDPR and the ePrivacy Directive. UK users require compliance with PECR. California users have opt-out rights for cookie-based advertising data sharing under CPRA. Regulators in France (CNIL), Germany (DSK), and Ireland (DPC) have been particularly active in cookie consent enforcement. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers deploying Canva in employee workflows should assess whether employee browsing data collected via advertising cookies is consistent with workplace privacy policies and applicable employment law requirements in relevant jurisdictions. COMPLIANCE CONSIDERATIONS: Compliance teams should test Canva's cookie consent banner to verify that non-essential cookies are not loaded prior to user consent for EU deployments, that the banner provides equal prominence to accept and reject options, and that consent records are maintained. For California deployments, confirm that the opt-out mechanism for advertising cookies is functional and documented.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy distinguishes between essential and optional cookies, and the availability of a cookie settings tool is relevant to GDPR and ePrivacy consent obligations for EU users. The practical adequacy of consent obtained through the cookie banner cannot be assessed from policy text alone.
Canva's policy states that advertising and analytics cookies are optional and can be managed through a cookie preferences tool. Users who do not adjust their settings may have browsing and usage behavior tracked across Canva and potentially on partner sites for advertising purposes.
ConductAtlas has identified this type of provision across 79 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Canva.