Cookies and Tracking Technologies

What it is

Canva uses cookies for both essential platform functions and optional purposes including advertising targeting and analytics. Non-essential cookies can be managed through a cookie settings tool.

Why it matters (compliance & governance perspective)

The policy distinguishes between essential and optional cookies, and the availability of a cookie settings tool is relevant to GDPR and ePrivacy consent obligations for EU users. The practical adequacy of consent obtained through the cookie banner cannot be assessed from policy text alone.

This document changed recently

Consumer impact (what this means for users)

Canva's policy states that advertising and analytics cookies are optional and can be managed through a cookie preferences tool. Users who do not adjust their settings may have browsing and usage behavior tracked across Canva and potentially on partner sites for advertising purposes.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates the EU ePrivacy Directive and GDPR Article 6 for EU users, requiring prior informed consent for non-essential cookies. The UK equivalent is the Privacy and Electronic Communications Regulations (PECR). The FTC Act applies for US users in the context of disclosed cookie practices. CCPA and CPRA are relevant for California users where cookie-based behavioral data constitutes 'sharing' for advertising purposes. GOVERNANCE EXPOSURE: Medium. Cookie consent compliance is a well-documented compliance area with active regulatory enforcement in the EU. The critical question is whether Canva's cookie consent mechanism meets the GDPR standard of freely given, specific, informed, and unambiguous consent, including whether pre-ticked boxes or default opt-in settings are used for non-essential cookies. JURISDICTION FLAGS: EU and EEA users are subject to the most stringent requirements under GDPR and the ePrivacy Directive. UK users require compliance with PECR. California users have opt-out rights for cookie-based advertising data sharing under CPRA. Regulators in France (CNIL), Germany (DSK), and Ireland (DPC) have been particularly active in cookie consent enforcement. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers deploying Canva in employee workflows should assess whether employee browsing data collected via advertising cookies is consistent with workplace privacy policies and applicable employment law requirements in relevant jurisdictions. COMPLIANCE CONSIDERATIONS: Compliance teams should test Canva's cookie consent banner to verify that non-essential cookies are not loaded prior to user consent for EU deployments, that the banner provides equal prominence to accept and reject options, and that consent records are maintained. For California deployments, confirm that the opt-out mechanism for advertising cookies is functional and documented.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• User Content Used for AI and Service Improvement high
• Data Sharing with Advertising and Analytics Partners medium
• Cross-Border Data Transfers and Standard Contractual Clauses medium
• Children and Education Product Privacy high
• User Data Rights Including Access, Correction, and Deletion medium
• Data Retention low

Related Analysis

• Netflix Updated Terms Authorize Voice Data Collection: April 2026

  Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.

• What Google Actually Knows About You

  Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.