California residents have the right to know what data Duolingo holds about them, delete it, correct it, opt out of its sale or sharing for advertising, and limit use of sensitive personal information.
This analysis describes what Duolingo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy explicitly enumerates CCPA and CPRA rights for California residents, including the right to opt out of data sharing for cross-context behavioral advertising, which is a concrete and exercisable consumer protection.
The updated privacy policy no longer contains explicit language stating that Duolingo uses cookies to enhance user experience and analyze performance, or that it shares user information with social media, advertising, and analytics partners. The policy also no longer displays a 'Do Not Sell My Personal Information' button. These removals may affect the transparency of Duolingo's practices as disclosed in the policy document itself, though actual data practices may remain unchanged. Users should review the complete updated privacy policy to understand current disclosures about data collection and sharing.
View change record →The updated policy now discloses a new Math Tutor feature that processes audio through Apple for transcription; audio is deleted but text transcripts may be retained and shared with AI vendors. Duolingo also clarified that IP addresses may be retained longer than 30 days for paying subscribers specifically for payment processing and fraud prevention. The policy changed the Video Call feature from 'Duolingo offers' to 'Duolingo may offer', clarifying it is optional. You can disable FullStory and Session Replay activity recording using the Tracking toggle in app Settings.
View change record →Replaced 'right to non-discrimination for exercising your privacy rights' with 'right to limit the use and disclosure of sensitive personal information' and softened language from 'you have the right' to 'you have certain rights.'
View full change record →California residents can exercise rights to access, delete, correct, and opt out of the sale or sharing of their personal information by contacting Duolingo, with the policy providing privacy@duolingo.com as the contact mechanism.
How other platforms handle this
If you are a California resident, you have the right to: Know what personal information is being collected about you; Know whether your personal information is sold or disclosed and to whom; Say no to the sale of personal information; Access your personal information; Request deletion of your person...
If you are a California resident, you have the right to know what personal information we collect, use, and disclose about you; the right to request deletion of your personal information; the right to opt out of the sale or sharing of your personal information; the right to correct inaccurate person...
Depending on where you are located, you may have certain rights regarding your personal information, including the right to access, correct, delete, or restrict processing of your personal information, the right to data portability, and the right to object to or withdraw consent for certain processi...
Monitoring
Duolingo has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you are a California resident, you have certain rights with respect to your personal information, including the right to know about the personal information we collect, use, disclose, and sell; the right to delete personal information we have collected from you; the right to opt out of the sale or sharing of your personal information; the right to correct inaccurate personal information; and the right to limit the use and disclosure of sensitive personal information.— Excerpt from Duolingo's Duolingo Privacy Policy
REGULATORY LANDSCAPE: This provision directly implements rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General. The provision must comply with specific requirements for response timelines (generally 45 days with a possible 45-day extension), identity verification, and non-discrimination against users who exercise their rights. GOVERNANCE EXPOSURE: Medium. The enumeration of rights is consistent with CCPA and CPRA statutory requirements. Compliance risk arises from the operationalization of these rights, including the adequacy of identity verification processes, the timeliness of responses, and whether the opt-out mechanism for sharing of personal data for advertising is clearly accessible and effective. JURISDICTION FLAGS: This provision applies specifically to California residents. Other US state privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA) grant similar but not identical rights, and Duolingo may need to expand its rights framework to cover users in those states as those laws mature. CONTRACT AND VENDOR IMPLICATIONS: Duolingo's advertising and analytics partners who receive shared personal data must honor opt-out signals received from California users. Vendor agreements should include provisions requiring downstream compliance with CCPA opt-out requests. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the process for receiving and fulfilling California rights requests is operationally functional, that response timelines comply with statutory requirements, and that identity verification procedures do not create unreasonable barriers to exercising rights. The opt-out mechanism for sharing of personal data for advertising should be tested for clarity and effectiveness.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy explicitly enumerates CCPA and CPRA rights for California residents, including the right to opt out of data sharing for cross-context behavioral advertising, which is a concrete and exercisable consumer protection.
California residents can exercise rights to access, delete, correct, and opt out of the sale or sharing of their personal information by contacting Duolingo, with the policy providing privacy@duolingo.com as the contact mechanism.
ConductAtlas has identified this type of provision across 16 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Duolingo.