Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision states that Duolingo relies on the EU-U.S. DPF, UK Extension to the DPF, and Swiss-U.S. DPF as the legal mechanism for transferring personal data from the EU, UK, and Switzerland to the United States, and that Duolingo retains liability under DPF Principles for data transferred to third-party agents that process it inconsistently with those Principles.
This analysis describes what Duolingo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the international data transfer legal basis for EU, UK, and Swiss user data processed in the United States, and affirms FTC jurisdiction over DPF compliance. Duolingo's ongoing DPF certification requires annual renewal and is subject to FTC enforcement action for material misrepresentation of compliance.
The updated policy removes explicit language stating that Android users and website users are not subject to audio collection for product improvement purposes. Previously, the policy authorized audio collection only from iOS users, with an explicit carve-out for Android and web users. The revised language now states that all users may choose not to share audio within app Settings, suggesting audio collection may now occur across all platforms unless the opt-out mechanism is used. The practical operational effect of this change depends on whether Duolingo implements audio collection on Android and web platforms, which the policy change does not explicitly confirm. You can decline audio sharing for product improvement by adjusting the setting within the app.
View change record →Under this provision, EU, UK, and Swiss users' personal data is transferred to the United States under the DPF framework, with Duolingo remaining liable for processing by third-party agents that violates DPF Principles. EU, UK, and Swiss individuals may direct unresolved DPF complaints to their respective supervisory authorities.
Cross-platform context
See how other platforms handle EU-U.S. Data Privacy Framework and International Data Transfer and similar clauses.
Compare across platforms →Monitoring
Duolingo has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Duolingo complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Duolingo has responsibility for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. Duolingo shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless Duolingo proves that it is not responsible for the event giving rise to the damage. The Federal Trade Commission has jurisdiction over Duolingo's compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).Excerpt from Duolingo's Privacy Policy
1) REGULATORY LANDSCAPE: The EU-U.S. DPF is administered by the U.S. Department of Commerce and enforced by the FTC. It was established following the Court of Justice of the European Union's Schrems II decision invalidating Privacy Shield. The DPF's adequacy decision by the European Commission may be subject to future legal challenge. UK users are covered by the UK Extension, and Swiss users by the Swiss-U.S. DPF. Duolingo's liability for agent processing under DPF Principles mirrors the onward transfer accountability principle under GDPR Article 28. 2) GOVERNANCE EXPOSURE: Medium. DPF certification provides a recognized transfer mechanism but requires annual renewal and ongoing compliance with DPF Principles. If Duolingo's certification lapses or is found to be materially inaccurate, EU-to-US data transfers may lose their legal basis. The FTC's enforcement authority over DPF misrepresentation creates regulatory exposure for certification gaps. 3) JURISDICTION FLAGS: EU and EEA users, UK users, and Swiss users are the primary affected populations. Organizations in these jurisdictions that rely on Duolingo for educational or operational purposes should verify current DPF certification status at dataprivacyframework.gov. Any future invalidation of the DPF adequacy decision would require Duolingo to identify an alternative transfer mechanism. 4) VENDOR AND CONTRACT IMPLICATIONS: Duolingo's DPF liability for agent processing means that data processing agreements with sub-processors must include DPF-compliant onward transfer terms. Organizations conducting vendor due diligence on Duolingo should verify the scope of sub-processor disclosures and whether DPF Principles are flowed down to named AI vendors including OpenAI and Google. 5) COMPLIANCE CONSIDERATIONS: Legal teams should verify Duolingo's active DPF certification at https://www.dataprivacyframework.gov/ prior to or during vendor onboarding. The policy states that DPF Principles govern in the event of conflict with policy terms, which may be relevant in disputes about data subject rights for EU, UK, and Swiss users. Organizations should document reliance on Duolingo's DPF certification in their data transfer impact assessments.
This provision establishes the international data transfer legal basis for EU, UK, and Swiss user data processed in the United States, and affirms FTC jurisdiction over DPF compliance. Duolingo's ongoing DPF certification requires annual renewal and is subject to FTC enforcement action for material misrepresentation of compliance.
Under this provision, EU, UK, and Swiss users' personal data is transferred to the United States under the DPF framework, with Duolingo remaining liable for processing by third-party agents that violates DPF Principles. EU, UK, and Swiss individuals may direct unresolved DPF complaints to their respective supervisory authorities.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Duolingo.