Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision states that Duolingo may anonymize personal information and use the resulting de-identified data for any purpose, including AI model training, asserting that such data falls outside the definition of personal information because it cannot identify individuals.
This analysis describes what Duolingo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision reserves broad secondary use rights over de-identified data derived from user activity. The practical scope of this authorization depends on the robustness of the anonymization method applied, which the policy does not describe in technical detail; applicable law in some jurisdictions may impose standards for what constitutes adequate de-identification.
Interpretive note: The enforceability of the 'for any purpose' authorization depends on the robustness of the anonymization method applied, which the policy does not describe; applicable law in some jurisdictions may evaluate de-identification adequacy differently.
The updated policy removes explicit language stating that Android users and website users are not subject to audio collection for product improvement purposes. Previously, the policy authorized audio collection only from iOS users, with an explicit carve-out for Android and web users. The revised language now states that all users may choose not to share audio within app Settings, suggesting audio collection may now occur across all platforms unless the opt-out mechanism is used. The practical operational effect of this change depends on whether Duolingo implements audio collection on Android and web platforms, which the policy change does not explicitly confirm. You can decline audio sharing for product improvement by adjusting the setting within the app.
View change record →Under this provision, Duolingo may derive anonymized datasets from user personal information and use those datasets without stated purpose restriction, including for AI training. The policy asserts that anonymized data is not personal information, though applicable law in certain jurisdictions may evaluate de-identification adequacy differently.
Cross-platform context
See how other platforms handle Anonymized Data Use for Any Purpose Including AI Training and similar clauses.
Compare across platforms →Monitoring
Duolingo has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Duolingo may anonymize your personal information, and use this de-identified data for any purpose, such as better understanding learning trends and training artificial intelligence models. Such information is not considered personal information since it cannot identify any individual.Excerpt from Duolingo's Privacy Policy
1) REGULATORY LANDSCAPE: GDPR Recital 26 and applicable guidance from EU data protection authorities establish that de-identification must be robust and irreversible to remove data from GDPR scope; pseudonymized data does not qualify. CCPA defines de-identified data and imposes technical and administrative safeguards requirements. The EU AI Act may impose obligations on datasets used to train AI systems even where individual identification is claimed to be absent. 2) GOVERNANCE EXPOSURE: Medium. The policy does not disclose the technical anonymization method applied, which makes it difficult to independently assess whether the de-identification meets the standards required for GDPR exclusion or CCPA de-identified data treatment. If re-identification is technically feasible, the 'for any purpose' use claim may face regulatory challenge. 3) JURISDICTION FLAGS: EU and EEA users face the greatest exposure if anonymization does not meet GDPR Article 4 and Recital 26 standards, as GDPR would continue to apply. California users should note that CCPA's de-identification standard requires specific technical and contractual safeguards. The 'for any purpose' framing may require evaluation under EU AI Act provisions on training data governance. 4) CONTRACT AND VENDOR IMPLICATIONS: If de-identified data is shared with AI vendors for model training purposes, vendor agreements should specify anonymization standards and prohibit re-identification attempts. The policy does not disclose whether de-identified data is shared with third parties or retained internally only. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should request documentation of Duolingo's anonymization methodology to assess whether it satisfies applicable legal standards in relevant jurisdictions. Data mapping exercises should distinguish between pseudonymized and fully anonymized data flows. Legal teams in EU-facing organizations should evaluate whether the 'for any purpose' assertion is consistent with GDPR purpose limitation principles applied to borderline de-identification cases.
This provision reserves broad secondary use rights over de-identified data derived from user activity. The practical scope of this authorization depends on the robustness of the anonymization method applied, which the policy does not describe in technical detail; applicable law in some jurisdictions may impose standards for what constitutes adequate de-identification.
Under this provision, Duolingo may derive anonymized datasets from user personal information and use those datasets without stated purpose restriction, including for AI training. The policy asserts that anonymized data is not personal information, though applicable law in certain jurisdictions may evaluate de-identification adequacy differently.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Duolingo.