Data Sharing with Advertising and Analytics Partners

What it is

Canva states it shares device identifiers, usage data, and inferred interest information with advertising and analytics companies to serve targeted ads and measure platform performance.

Why it matters (compliance & governance perspective)

This provision authorizes sharing of behavioral and device data with third-party ad and analytics networks, which has implications for CCPA opt-out rights and GDPR consent requirements for tracking-based advertising.

This document changed recently

Consumer impact (what this means for users)

Canva's policy states it may share your device identifiers and usage data with advertising partners, meaning your browsing behavior and inferred interests on Canva may be used to serve targeted advertising by third parties. California residents have the right to opt out of this sharing under CCPA.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates CCPA and CPRA, which classify sharing personal information with advertising networks for cross-context behavioral advertising as a regulated activity requiring an opt-out mechanism. GDPR Article 6 and the ePrivacy Directive apply for EU users, requiring consent for non-essential tracking. The FTC Act applies for US users regarding transparency of behavioral advertising data flows. GOVERNANCE EXPOSURE: Medium. Advertising data sharing is a common practice but is actively regulated under CCPA and GDPR. The key compliance question is whether Canva's opt-out mechanism for advertising data sharing is implemented as a prominent and functional 'Do Not Sell or Share My Personal Information' link as required under CPRA, and whether EU users receive a compliant consent mechanism prior to tracking cookie activation. JURISDICTION FLAGS: California residents have the most specific statutory opt-out rights under CCPA and CPRA. EU and UK users require prior consent for behavioral advertising under GDPR and ePrivacy rules. Users in states with comprehensive privacy laws such as Virginia (VCDPA), Colorado (CPA), and Connecticut (CTDPA) may also have opt-out rights. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams at organizations using Canva should assess whether employee usage data is being routed to advertising networks and whether enterprise or education agreements include data use restrictions that override these default sharing practices. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Canva's cookie consent banner provides a genuine pre-consent opt-out for advertising cookies in EU deployments. For California-based organizations, confirm that the opt-out link is accessible and functional. Internal policies governing employee use of Canva should note that behavioral usage data may be shared with advertising partners unless controls are exercised.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• User Content Used for AI and Service Improvement high
• Cross-Border Data Transfers and Standard Contractual Clauses medium
• Children and Education Product Privacy high
• User Data Rights Including Access, Correction, and Deletion medium
• Cookies and Tracking Technologies medium
• Data Retention low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.