Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision discloses that FullStory and a Session Replay service log user activity including clicks, mouse movements, scrolling, typing, browser and device information, IP address, pages visited, and learning activity. Users can disable these services using the Tracking toggle in app Settings; both are disabled by default for Child Users.
This analysis describes what Duolingo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The updated policy removes explicit language stating that Android users and website users are not subject to audio collection for product improvement purposes. Previously, the policy authorized audio collection only from iOS users, with an explicit carve-out for Android and web users. The revised language now states that all users may choose not to share audio within app Settings, suggesting audio collection may now occur across all platforms unless the opt-out mechanism is used. The practical operational effect of this change depends on whether Duolingo implements audio collection on Android and web platforms, which the policy change does not explicitly confirm. You can decline audio sharing for product improvement by adjusting the setting within the app.
View change record →Under this provision, Duolingo logs detailed session activity including typing, mouse movements, and learning answers through FullStory and a Session Replay service by default for non-child users. Users can disable this recording using the Tracking toggle in app Settings.
How other platforms handle this
Category F: Internet or other similar network activity. Examples: Interaction with our Service or advertisement. Collected: Yes.
authorize ZipRecruiter to connect your account to the account of a "Connected Site" (e.g., Google, LinkedIn, Monster, Facebook or Twitter), we may be able to access information you have provided to the Connected Site...
telemetry information collected includes: (i) microservice settings, (ii) usage data and (iii) hardware environment.
Monitoring
Duolingo has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"When you use Duolingo in our app or on our website, some of your activity will be logged by services called FullStory and Session Replay.Excerpt from Duolingo's Privacy Policy
1) REGULATORY LANDSCAPE: Session replay tools that capture keystroke-level typing activity may implicate wiretapping and electronic communications interception statutes, including the California Invasion of Privacy Act and analogous state wiretapping laws, depending on how the capture is implemented and disclosed. GDPR Article 5 data minimization principles apply to the breadth of behavioral data captured. The FTC Act is relevant to the adequacy of disclosure and opt-out mechanisms for session recording. 2) GOVERNANCE EXPOSURE: Medium. The policy discloses both services by name and specifies the categories of data captured. The opt-out mechanism is available through app Settings. However, the default-on enrollment for adult users and the capture of typing activity may attract regulatory scrutiny in jurisdictions with active enforcement of electronic monitoring disclosure requirements. 3) JURISDICTION FLAGS: California users should be aware that CIPA and its application to session replay has been the subject of active litigation; legal applicability depends on whether the capture is characterized as interception. Illinois users may have additional exposure under state electronic privacy statutes. EU and UK users are subject to GDPR and ePrivacy Directive cookie and tracking consent requirements that may require affirmative opt-in for session replay. 4) CONTRACT AND VENDOR IMPLICATIONS: FullStory operates as a third-party data processor; organizations using Duolingo in enterprise or institutional contexts should verify whether FullStory's data processing agreement and sub-processing terms are compatible with their own data governance obligations. The policy discloses specific exclusions for passwords, email addresses, and certain profile data from FullStory's recording scope. 5) COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether the Tracking toggle opt-out mechanism satisfies GDPR consent requirements for EU users, as session replay may constitute non-essential tracking requiring prior consent. Data mapping should reflect FullStory's data processing relationship with Duolingo. Organizations with employees or contractors using Duolingo should assess whether electronic monitoring disclosure obligations apply.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
This provision discloses that FullStory and a Session Replay service log user activity including clicks, mouse movements, scrolling, typing, browser and device information, IP address, pages visited, and learning activity. Users can disable these services using the Tracking toggle in app Settings; both are disabled by default for Child Users.
Under this provision, Duolingo logs detailed session activity including typing, mouse movements, and learning answers through FullStory and a Session Replay service by default for non-child users. Users can disable this recording using the Tracking toggle in app Settings.
ConductAtlas has identified this type of provision across 303 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Duolingo.