8 Total
4 High severity
4 Medium severity
0 Low severity
Summary

This is Duolingo's privacy policy explaining what personal information the language-learning app collects about you and how it uses it. Duolingo collects a wide range of data including your voice recordings, learning activity, device identifiers, and purchase history, and shares some of this data with advertising partners for targeted ads. If you are a California resident, you can opt out of the sale or sharing of your personal data by visiting Duolingo's privacy settings or submitting a request through their privacy portal.

Technical Summary

Duolingo's privacy policy governs the collection, use, and sharing of personal data for users of its language learning platform, apps, and related services, operating under a consent and legitimate interests framework consistent with GDPR Art. 6 and CCPA §1798.100. The policy obligates Duolingo to provide data access, deletion, and portability rights, while imposing on users an implicit acceptance of broad data collection including voice recordings, usage patterns, purchase history, device identifiers, and inferred characteristics used for personalization and advertising. A notable provision permits Duolingo to share data with 'advertising partners' and to use data for targeted advertising, including via third-party trackers (Google, Facebook/Meta pixel observed in page source), which creates heightened risk under GDPR consent requirements and CCPA opt-out obligations for data sales/sharing. The policy references COPPA compliance for users under 13 and provides a separate children's privacy section, engaging DOE/FERPA considerations given Duolingo's educational context and school-facing products (Duolingo for Schools). California residents are granted CCPA rights including opt-out of data sale/sharing, and EU/EEA residents are afforded GDPR rights, but the policy's relatively broad legitimate interests claims and advertising data sharing warrant close scrutiny from DPAs and state AGs.

Evidence Provenance
Captured April 21, 2026 06:05 UTC
Document ID CA-D-000084
Version ID CA-V-000855
Wayback Machine View archived versions →
SHA-256 cdb1aa0d3bfd4be264e86c80c3c612593edeebe1fad643a91ca3dd3b93e33ae8
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Cryptographically signed
Institutional Analysis

🔒 Institutional analysis locked

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.

Upgrade to Professional — $149/mo
Change Timeline
View full version history (0 captures) →
Analyzed Changes

1 change analyzed since monitoring began.

What changed Duolingo updated their Duolingo Privacy Policy on April 21, 2026. Change detected: 5 sentence(s) added, 12 sentence(s) modified. Document contained 219 sentences after update.
Consumer impact Duolingo's updated policy introduces a Math Tutor feature that sends your audio to Apple for speech recognition before deletion, but the resulting text transcript can be retained by Duolingo and shared with AI vendors — a new data-sharing pathway not previously disclosed. If you pay for a Duolingo subscription, your IP address may now be held indefinitely (beyond 30 days) for payment and fraud purposes. You can disable FullStory and Session Replay activity recording by using the Tracking toggle within the app Settings.
Why it matters Duolingo has introduced new audio and transcript sharing with Apple and unnamed AI vendors through the Math Tutor feature, while simultaneously removing a protective commitment about what FullStory cannot record — expanding the scope of data collection and third-party sharing without equivalent new protections. Paying subscribers are also subject to longer IP address storage, and a new session replay tool adds another layer of behavioral monitoring.

Recent Clause-Level Changes Apr 21, 2026

8 provisions unchanged.

View full change record →
High Severity — 4 provisions
Medium Severity — 4 provisions

Cross-platform context

See how other platforms handle Advertising Data Sharing with Third Parties and similar clauses.

Compare across platforms →

Applicable Regulations

EU AI Act
European Union
CCPA/CPRA
California, USA
COPPA
United States Federal
CFAA
United States Federal
CAN-SPAM
United States Federal
GDPR
European Union
UK GDPR
United Kingdom