Canva shares your usage and behavioral data with outside advertising companies and social media platforms to serve you targeted ads both on Canva and across the web on other sites.
This analysis describes what Canva's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause establishes a data-sharing framework that enables cross-platform advertising measurement and targeting. This practice is operationally significant because it extends data use beyond Canva's direct service delivery to support its advertising and performance assessment infrastructure.
The updated privacy policy no longer explicitly discloses that Canva uses cookies to personalize ads, analyze website performance, or tailor content on partner sites. Previously, the policy stated these purposes and directed users to the cookie policy for more information and choice. The revised policy now mentions only that essential cookies are used to make Canva work. This change removes transparency about non-essential cookie uses and eliminates the cookie consent interface (Accept all cookies / Manage cookies buttons) that was previously presented in the privacy policy document itself.
View change record →The updated privacy policy no longer includes explicit language describing Canva's use of non-essential cookies for personalization, advertising tailoring, and website analytics. Previously, the policy stated that Canva would use these cookies only if users accepted. The removal of this disclosure means the policy no longer clearly explains these cookie categories or presents a consent interaction for non-essential cookies at the point where this information was previously disclosed. Depending on applicable cookie law and Canva's implementation, users may need to consult additional documentation such as a separate cookie policy to understand how non-essential cookies are managed.
View change record →The updated privacy policy no longer explicitly discloses optional cookie uses or provides cookie preference controls on the privacy policy page itself. Previously, Canva stated it would use non-essential cookies for personalization, ad targeting, and analytics only if users accepted, and offered 'Accept all cookies' and 'Manage cookies' options. The removal of this disclosure and consent mechanism may affect how users understand cookie practices and when consent is obtained. Users who previously accessed cookie preferences through the privacy policy will need to locate these controls elsewhere on the Canva platform if they remain available.
View change record →Your browsing and usage behavior on Canva may be shared with advertising networks and social media platforms, resulting in targeted ads served to you on other websites based on your Canva activity. California residents can opt out of this sharing, and EU and UK users should be offered a consent choice via cookie banner before this sharing occurs.
How other platforms handle this
We may share your information with third-party vendors and service providers that perform services on our behalf, such as payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance. We may also share your information with third-party advertising p...
We may share your personal information with third-party vendors and service providers that perform services on our behalf, such as payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance. We may also share your personal information with busines...
We permit third-party service providers to collect your information, as described here, through some of our services and we share your information with third-party service providers for business purposes as described in this policy, including but not limited to providing advertising on our services ...
Monitoring
Canva has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We work with third party companies to help us advertise to you on third party websites and to measure the effectiveness of our advertising campaigns. These companies may use information about your visits to our website and other websites to provide relevant advertisements about goods and services that may be of interest to you. We also share information with social media platforms, advertising networks, and analytics providers.— Excerpt from Canva's Canva Privacy Policy
REGULATORY LANDSCAPE: This provision implicates GDPR Articles 6 and 7 (lawful basis and consent requirements for sharing with advertising third parties), the ePrivacy Directive (cookie and tracking consent), CCPA and CPRA (which define sharing personal information with third parties for cross-context behavioral advertising as a regulated activity requiring opt-out rights), and the FTC Act's unfair or deceptive practices framework. Enforcement authorities include EU supervisory authorities, the UK ICO, the California Privacy Protection Agency, and the FTC. GOVERNANCE EXPOSURE: High. Sharing behavioral and usage data with advertising networks and social media platforms for targeted advertising is a high-scrutiny practice under GDPR and CCPA. The lawfulness of this sharing for EU and UK users depends entirely on whether valid consent is obtained through the cookie consent mechanism before any advertising trackers fire. Any misconfiguration of consent management could result in unlawful processing. JURISDICTION FLAGS: EU and EEA users require explicit opt-in consent for behavioral advertising cookies under the ePrivacy Directive. California residents have a CPRA right to opt out of sharing of personal information with third parties for cross-context behavioral advertising. UK users are subject to the UK GDPR and PECR, requiring similar consent standards. Users in other jurisdictions may have fewer formal protections. CONTRACT AND VENDOR IMPLICATIONS: Organizations procuring Canva for business use should assess whether employee usage data is being routed to advertising partners and whether this is permissible under their internal data governance policies. Vendor assessments should confirm that Canva's data processing agreements with advertising partners meet GDPR Article 28 processor requirements or, where those partners act as independent controllers, that appropriate data sharing agreements are in place. COMPLIANCE CONSIDERATIONS: Compliance teams should audit Canva's cookie consent banner to verify that advertising and analytics cookies are not loaded before user consent is captured for EU and UK users. California-facing teams should confirm the CCPA opt-out mechanism is functional and prominently disclosed. Data mapping should capture the flow of behavioral data from Canva to named third-party advertising partners.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The clause establishes a data-sharing framework that enables cross-platform advertising measurement and targeting. This practice is operationally significant because it extends data use beyond Canva's direct service delivery to support its advertising and performance assessment infrastructure.
Your browsing and usage behavior on Canva may be shared with advertising networks and social media platforms, resulting in targeted ads served to you on other websites based on your Canva activity. California residents can opt out of this sharing, and EU and UK users should be offered a consent choice via cookie banner before this sharing occurs.
ConductAtlas has identified this type of provision across 25 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Canva.