EEA and UK User Rights Under GDPR

What it is

If you use Duolingo from Europe or the UK, you have GDPR rights to access, correct, delete, and move your personal data, and to object to how it is being used.

Why it matters (compliance & governance perspective)

GDPR rights are among the strongest data protection rights globally and are directly enforceable against Duolingo for EEA and UK users, including the right to withdraw consent for data processing at any time, which can affect how your learning data and voice recordings are used.

This document changed recently

Consumer impact (what this means for users)

EU and UK Duolingo users can exercise legally binding rights to access all data held about them, have it deleted, corrected, or transferred, and can object to processing for direct marketing or automated decision-making. These rights are enforceable through national data protection authorities if Duolingo fails to respond appropriately.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR (Regulation 2016/679) and the UK GDPR as retained in UK law post-Brexit. Applicable enforcement authorities include national data protection authorities in each EU member state, the Irish Data Protection Commission (likely Duolingo's EU lead supervisory authority given US headquarters), and the UK ICO. Key GDPR articles engaged include Articles 15-22 (data subject rights) and Article 77 (right to lodge a complaint with a supervisory authority). (2) GOVERNANCE EXPOSURE: Medium. The disclosure of GDPR rights is legally required and the policy's inclusion is a positive compliance indicator. Operational exposure exists around response times (GDPR requires response within one month, extendable to three), the adequacy of identity verification processes that do not create excessive barriers to rights exercise, and the legal basis stated for each processing activity. If Duolingo relies on legitimate interests as a legal basis for behavioral advertising in the EEA, this may face challenge under GDPR's balancing test. (3) JURISDICTION FLAGS: All EU member states and the UK. The Irish DPC is the likely lead supervisory authority under the GDPR one-stop-shop mechanism. Post-Brexit UK users are governed by UK GDPR and the ICO, which may diverge from EU standards over time. Cross-border data transfers from the EU to the US must rely on an approved transfer mechanism such as the EU-US Data Privacy Framework or Standard Contractual Clauses. (4) CONTRACT AND VENDOR IMPLICATIONS: Data Processing Agreements with all processors handling EEA or UK user data must comply with GDPR Article 28 requirements. Transfer mechanisms for data flows to US-based advertising technology vendors should be documented and maintained current, given ongoing legal developments in this area. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that a valid and documented legal basis exists for each category of processing described in the policy, particularly for behavioral advertising and voice data processing. The Data Protection Impact Assessment (DPIA) requirement under GDPR Article 35 should be evaluated for high-risk processing activities including voice recording and AI model training. Rights request workflows should be tested for compliance with GDPR's response time and format requirements.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Voice Recording Collection and Use high
• Third-Party Advertising Data Sharing medium
• Children's Privacy and COPPA Compliance high
• Data Retention Discretion medium
• California Resident Rights (CCPA/CPRA) low
• Cross-Border Data Transfers medium