Third-Party Advertising and Analytics Data Sharing

What it is

Canva shares your usage and behavioral data with outside advertising companies and social media platforms to serve you targeted ads both on Canva and across the web on other sites.

Why it matters (compliance & governance perspective)

This means information about how you use Canva can follow you to other websites in the form of targeted advertising, and multiple third-party companies may receive your behavioral data.

This document changed recently

Consumer impact (what this means for users)

Your browsing and usage behavior on Canva may be shared with advertising networks and social media platforms, resulting in targeted ads served to you on other websites based on your Canva activity. California residents can opt out of this sharing, and EU and UK users should be offered a consent choice via cookie banner before this sharing occurs.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates GDPR Articles 6 and 7 (lawful basis and consent requirements for sharing with advertising third parties), the ePrivacy Directive (cookie and tracking consent), CCPA and CPRA (which define sharing personal information with third parties for cross-context behavioral advertising as a regulated activity requiring opt-out rights), and the FTC Act's unfair or deceptive practices framework. Enforcement authorities include EU supervisory authorities, the UK ICO, the California Privacy Protection Agency, and the FTC. GOVERNANCE EXPOSURE: High. Sharing behavioral and usage data with advertising networks and social media platforms for targeted advertising is a high-scrutiny practice under GDPR and CCPA. The lawfulness of this sharing for EU and UK users depends entirely on whether valid consent is obtained through the cookie consent mechanism before any advertising trackers fire. Any misconfiguration of consent management could result in unlawful processing. JURISDICTION FLAGS: EU and EEA users require explicit opt-in consent for behavioral advertising cookies under the ePrivacy Directive. California residents have a CPRA right to opt out of sharing of personal information with third parties for cross-context behavioral advertising. UK users are subject to the UK GDPR and PECR, requiring similar consent standards. Users in other jurisdictions may have fewer formal protections. CONTRACT AND VENDOR IMPLICATIONS: Organizations procuring Canva for business use should assess whether employee usage data is being routed to advertising partners and whether this is permissible under their internal data governance policies. Vendor assessments should confirm that Canva's data processing agreements with advertising partners meet GDPR Article 28 processor requirements or, where those partners act as independent controllers, that appropriate data sharing agreements are in place. COMPLIANCE CONSIDERATIONS: Compliance teams should audit Canva's cookie consent banner to verify that advertising and analytics cookies are not loaded before user consent is captured for EU and UK users. California-facing teams should confirm the CCPA opt-out mechanism is functional and prominently disclosed. Data mapping should capture the flow of behavioral data from Canva to named third-party advertising partners.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• AI Feature Content Use for Model Improvement medium
• International Data Transfers via Standard Contractual Clauses medium
• California Resident Rights and CCPA Disclosure medium
• Design Content Access for Safety and Service Improvement medium
• Children Under 13 Data Restriction low
• Cookie and Tracking Technology Use medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.