This analysis describes what Canva's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause establishes the operational framework for international data processing by Canva's Australian headquarters and identifies the contractual mechanism (Standard Contractual Clauses) used to govern such transfers. This addresses jurisdictional compliance requirements for cross-border personal data flows.
The updated privacy policy no longer explicitly discloses that Canva uses cookies to personalize ads, analyze website performance, or tailor content on partner sites. Previously, the policy stated these purposes and directed users to the cookie policy for more information and choice. The revised policy now mentions only that essential cookies are used to make Canva work. This change removes transparency about non-essential cookie uses and eliminates the cookie consent interface (Accept all cookies / Manage cookies buttons) that was previously presented in the privacy policy document itself.
View change record →The updated privacy policy no longer includes explicit language describing Canva's use of non-essential cookies for personalization, advertising tailoring, and website analytics. Previously, the policy stated that Canva would use these cookies only if users accepted. The removal of this disclosure means the policy no longer clearly explains these cookie categories or presents a consent interaction for non-essential cookies at the point where this information was previously disclosed. Depending on applicable cookie law and Canva's implementation, users may need to consult additional documentation such as a separate cookie policy to understand how non-essential cookies are managed.
View change record →The updated privacy policy no longer explicitly discloses optional cookie uses or provides cookie preference controls on the privacy policy page itself. Previously, Canva stated it would use non-essential cookies for personalization, ad targeting, and analytics only if users accepted, and offered 'Accept all cookies' and 'Manage cookies' options. The removal of this disclosure and consent mechanism may affect how users understand cookie practices and when consent is obtained. Users who previously accessed cookie preferences through the privacy policy will need to locate these controls elsewhere on the Canva platform if they remain available.
View change record →Users located in the EEA, UK, and similar regions are notified that their personal data will be processed in jurisdictions with potentially different data protection standards, with Standard Contractual Clauses serving as the contractual safeguard for these transfers. The terms apply as written upon continued use of the service.
How other platforms handle this
Epic Games, Inc. is headquartered in Cary, North Carolina. We and our subsidiaries have offices and operations located around the world that help create and deliver some of your favorite products and services, including games like Fortnite and developer tools like Unreal Engine.
If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, please note that we transfer your personal data to countries outside of these regions, including the United States, which may not provide the same level of data protection as your home country. We rely on app...
Riot Games is based in the United States, and we may transfer your personal information to countries outside of your home country, including to the United States, which may have different data protection laws than your home country. When we transfer personal information from the European Economic Ar...
Monitoring
Canva has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Canva is headquartered in Australia, and the Service is operated from Australia. If you are located in the European Economic Area, the United Kingdom, or other regions with laws governing data collection and use, please note that your information may be transferred to and processed in countries that do not have the same data protection laws as your country of residence, including Australia and the United States. Where we transfer personal data from the EEA or the UK, we rely on appropriate transfer mechanisms, such as Standard Contractual Clauses, to protect your information.— Excerpt from Canva's Canva Privacy Policy
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The clause establishes the operational framework for international data processing by Canva's Australian headquarters and identifies the contractual mechanism (Standard Contractual Clauses) used to govern such transfers. This addresses jurisdictional compliance requirements for cross-border personal data flows.
Users located in the EEA, UK, and similar regions are notified that their personal data will be processed in jurisdictions with potentially different data protection standards, with Standard Contractual Clauses serving as the contractual safeguard for these transfers. The terms apply as written upon continued use of the service.
ConductAtlas has identified this type of provision across 85 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Canva.