Canva states it shares device identifiers, usage data, and inferred interest information with advertising and analytics companies to serve targeted ads and measure platform performance.
This analysis describes what Canva's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes sharing of behavioral and device data with third-party ad and analytics networks, which has implications for CCPA opt-out rights and GDPR consent requirements for tracking-based advertising.
The updated privacy policy no longer explicitly discloses that Canva uses cookies to personalize ads, analyze website performance, or tailor content on partner sites. Previously, the policy stated these purposes and directed users to the cookie policy for more information and choice. The revised policy now mentions only that essential cookies are used to make Canva work. This change removes transparency about non-essential cookie uses and eliminates the cookie consent interface (Accept all cookies / Manage cookies buttons) that was previously presented in the privacy policy document itself.
View change record →The updated privacy policy no longer includes explicit language describing Canva's use of non-essential cookies for personalization, advertising tailoring, and website analytics. Previously, the policy stated that Canva would use these cookies only if users accepted. The removal of this disclosure means the policy no longer clearly explains these cookie categories or presents a consent interaction for non-essential cookies at the point where this information was previously disclosed. Depending on applicable cookie law and Canva's implementation, users may need to consult additional documentation such as a separate cookie policy to understand how non-essential cookies are managed.
View change record →The updated privacy policy no longer explicitly discloses optional cookie uses or provides cookie preference controls on the privacy policy page itself. Previously, Canva stated it would use non-essential cookies for personalization, ad targeting, and analytics only if users accepted, and offered 'Accept all cookies' and 'Manage cookies' options. The removal of this disclosure and consent mechanism may affect how users understand cookie practices and when consent is obtained. Users who previously accessed cookie preferences through the privacy policy will need to locate these controls elsewhere on the Canva platform if they remain available.
View change record →Canva's policy states it may share your device identifiers and usage data with advertising partners, meaning your browsing behavior and inferred interests on Canva may be used to serve targeted advertising by third parties. California residents have the right to opt out of this sharing under CCPA.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We may display advertisements on our Services and those advertisements may be targeted to your interests based on your personal information. We may share your personal information with advertising partners for interest-based advertising purposes. You may opt out of interest-based advertising by visi...
Monitoring
Canva has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may share your information with third-party advertising partners to show you ads that we think will be relevant to you. We also share information with analytics providers to help us understand how people use our services. This may include sharing device identifiers, usage data, and inferred interests.— Excerpt from Canva's Canva Privacy Policy
REGULATORY LANDSCAPE: This provision implicates CCPA and CPRA, which classify sharing personal information with advertising networks for cross-context behavioral advertising as a regulated activity requiring an opt-out mechanism. GDPR Article 6 and the ePrivacy Directive apply for EU users, requiring consent for non-essential tracking. The FTC Act applies for US users regarding transparency of behavioral advertising data flows. GOVERNANCE EXPOSURE: Medium. Advertising data sharing is a common practice but is actively regulated under CCPA and GDPR. The key compliance question is whether Canva's opt-out mechanism for advertising data sharing is implemented as a prominent and functional 'Do Not Sell or Share My Personal Information' link as required under CPRA, and whether EU users receive a compliant consent mechanism prior to tracking cookie activation. JURISDICTION FLAGS: California residents have the most specific statutory opt-out rights under CCPA and CPRA. EU and UK users require prior consent for behavioral advertising under GDPR and ePrivacy rules. Users in states with comprehensive privacy laws such as Virginia (VCDPA), Colorado (CPA), and Connecticut (CTDPA) may also have opt-out rights. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams at organizations using Canva should assess whether employee usage data is being routed to advertising networks and whether enterprise or education agreements include data use restrictions that override these default sharing practices. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Canva's cookie consent banner provides a genuine pre-consent opt-out for advertising cookies in EU deployments. For California-based organizations, confirm that the opt-out link is accessible and functional. Internal policies governing employee use of Canva should note that behavioral usage data may be shared with advertising partners unless controls are exercised.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes sharing of behavioral and device data with third-party ad and analytics networks, which has implications for CCPA opt-out rights and GDPR consent requirements for tracking-based advertising.
Canva's policy states it may share your device identifiers and usage data with advertising partners, meaning your browsing behavior and inferred interests on Canva may be used to serve targeted advertising by third parties. California residents have the right to opt out of this sharing under CCPA.
ConductAtlas has identified this type of provision across 16 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Canva.