Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision states that IP addresses are retained for a maximum of 30 days under standard circumstances, with an exception permitting extended retention for subscribers who provide a payment method, limited to payment processing and fraud prevention purposes.
This analysis describes what Duolingo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a specific IP address retention timeline with a carve-out for payment subscribers that does not define a maximum extended retention period, which may require evaluation under GDPR data minimization and storage limitation principles for EU users.
Interpretive note: The absence of a defined maximum retention period for subscriber IP addresses introduces ambiguity regarding compliance with GDPR storage limitation principles; applicable regulatory guidance may impose additional constraints.
The updated policy removes explicit language stating that Android users and website users are not subject to audio collection for product improvement purposes. Previously, the policy authorized audio collection only from iOS users, with an explicit carve-out for Android and web users. The revised language now states that all users may choose not to share audio within app Settings, suggesting audio collection may now occur across all platforms unless the opt-out mechanism is used. The practical operational effect of this change depends on whether Duolingo implements audio collection on Android and web platforms, which the policy change does not explicitly confirm. You can decline audio sharing for product improvement by adjusting the setting within the app.
View change record →Under this provision, non-subscriber users' IP addresses are retained for up to 30 days. Users who purchase a Duolingo subscription and provide a payment method may have their IP address retained for an unspecified longer period for payment processing and fraud prevention purposes.
Cross-platform context
See how other platforms handle IP Address Retention and Payment Fraud Exception and similar clauses.
Compare across platforms →Monitoring
Duolingo has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We will retain your IP address for no more than thirty (30) days, unless exceptional circumstances require longer retention. If you purchase a Duolingo subscription and submit a payment method to Duolingo, Duolingo may retain your IP address for longer solely for purposes of payment processing and fraud prevention.Excerpt from Duolingo's Privacy Policy
1) REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept in a form that permits identification no longer than necessary for the stated purpose (storage limitation). The absence of a defined maximum retention period for subscriber IP addresses may require evaluation under this principle. CCPA includes IP addresses within the definition of personal information, and retention practices may be relevant to CCPA data minimization guidance. The FTC Act's unfair practices authority applies to data retention practices inconsistent with disclosed terms. 2) GOVERNANCE EXPOSURE: Low to Medium. The 30-day standard retention period is a specific and defined commitment. The extended retention exception for subscribers lacks a defined maximum, which may create exposure under GDPR storage limitation principles for EU users. The 'solely for purposes of payment processing and fraud prevention' limitation provides purpose-based scope control. 3) JURISDICTION FLAGS: EU and EEA users face the most significant exposure under GDPR storage limitation requirements where no maximum extended period is defined. California users should note that IP addresses are personal information under CCPA, and extended retention without a defined limit may be relevant to CCPA data minimization practices. 4) CONTRACT AND VENDOR IMPLICATIONS: Payment processing is conducted through Stripe, as disclosed elsewhere in the policy. The extended IP retention for fraud prevention may implicate Stripe's own data retention and processing terms, which should be reviewed in vendor assessments. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should request clarification from Duolingo on the maximum retention period for subscriber IP addresses and verify that retention schedules for IP addresses are documented and consistent with disclosed purposes. Data mapping exercises should distinguish between standard and extended IP retention populations.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a specific IP address retention timeline with a carve-out for payment subscribers that does not define a maximum extended retention period, which may require evaluation under GDPR data minimization and storage limitation principles for EU users.
Under this provision, non-subscriber users' IP addresses are retained for up to 30 days. Users who purchase a Duolingo subscription and provide a payment method may have their IP address retained for an unspecified longer period for payment processing and fraud prevention purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Duolingo.