Third-Party Advertising Data Sharing

What it is

Duolingo shares your personal data with advertising companies who use tracking technologies to build a profile of your interests and show you targeted ads across multiple platforms and websites.

Why it matters (compliance & governance perspective)

Sharing behavioral and usage data with advertising technology partners using cookies and pixel tags constitutes 'sharing' for cross-context behavioral advertising under CPRA, which triggers California opt-out rights and requires specific disclosures; similar rules apply under GDPR's consent requirements for behavioral advertising.

This document changed recently

Consumer impact (what this means for users)

Your Duolingo usage behavior, including what you learn and how you interact with the app, may be shared with advertising partners who combine it with data from other sources to target you with ads across the internet. California residents can opt out of this type of sharing under CPRA.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision directly engages the CCPA as amended by the CPRA, which defines 'sharing' for cross-context behavioral advertising as a regulated activity subject to opt-out rights, distinct from 'sale.' GDPR requires freely given, specific, informed consent for behavioral advertising cookies under ePrivacy Directive requirements. The FTC Act's prohibition on unfair or deceptive practices applies to the adequacy of disclosures about third-party advertising data flows. State privacy laws in Colorado, Virginia, Connecticut, and other states also confer opt-out rights for targeted advertising. (2) GOVERNANCE EXPOSURE: High. The combination of Facebook Pixel and Google Analytics integrations (observable in the page source) with a policy that authorizes behavioral advertising data sharing creates direct CPRA 'sharing' exposure and GDPR consent exposure. The adequacy of the current consent mechanism (cookie banner) for behavioral advertising consent under GDPR's Recital 32 standard warrants independent review. (3) JURISDICTION FLAGS: California (CPRA opt-out obligation), EU/EEA (GDPR and ePrivacy consent requirements), and an expanding set of US states with comprehensive privacy laws. Minor users in any jurisdiction create compounded exposure given restrictions on targeted advertising directed at children under COPPA, GDPR, and the UK Children's Code. (4) CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with advertising technology vendors should specify the purposes for which shared data may be used, prohibit secondary use for non-disclosed purposes, and address onward transfer restrictions. The policy's reference to pixel tags and similar technologies suggests real-time data flows that may require specific contractual controls to satisfy GDPR processor or joint controller requirements. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit all active advertising technology integrations against the policy's disclosures to ensure the list of partners is complete and current. Opt-out mechanisms for California users should be tested for functionality. Consent management platform configurations should be reviewed to ensure behavioral advertising scripts are not loaded prior to affirmative consent in GDPR-applicable regions.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Voice Recording Collection and Use high
• Children's Privacy and COPPA Compliance high
• Data Retention Discretion medium
• California Resident Rights (CCPA/CPRA) low
• EEA and UK User Rights Under GDPR low
• Cross-Border Data Transfers medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.