Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy asserts a set of globally applicable privacy rights including access, correction, deletion, objection, consent withdrawal, complaint, and non-discrimination rights. It acknowledges that specific rights and processes vary by jurisdiction and that Khan Academy may require identity verification before acting on requests.
This analysis describes what Khan Academy's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the range of privacy rights Khan Academy states it supports globally, which is operationally relevant for users in jurisdictions with enforceable privacy rights frameworks including GDPR, CCPA, and equivalent statutes. The policy acknowledges that its ability to fulfill specific requests may be limited by applicable law and service functionality.
Interpretive note: The policy acknowledges that specific rights, timelines, and processes vary by jurisdiction and that response capacity may be limited by applicable law and service functionality, making the practical scope of stated rights jurisdiction-dependent.
Under this provision, users may request access to, correction of, deletion of, or objection to the processing of their personal information by contacting Khan Academy. The agreement acknowledges that specific rights and applicable timelines vary by jurisdiction and that Khan Academy may require identity verification before acting on requests.
Cross-platform context
See how other platforms handle User Rights and Regional Privacy Rights and similar clauses.
Compare across platforms →Monitoring
Khan Academy has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Khan Academy's privacy practices are designed to support consumer privacy rights and expectations globally, including privacy rights that are common to many countries where our Services are available and which may be applicable to you. These include: the right to understand what personal information we collect, how we use it, how it is processed, stored and protected, who it is shared with, and whether it is sold the right to correct your personal information the right to request that your personal information be deleted or anonymized the right to object to how and why personal information is used or processed, including opting out of sale of personal information the right to withdraw consent to processing the right to make a complaint to the relevant supervisory authority; and the right to be free from discrimination based on exercising your privacy rightsExcerpt from Khan Academy's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR (Articles 15-21), CCPA/CPRA, and equivalent consumer privacy statutes in jurisdictions where Khan Academy operates. GDPR grants enforceable rights to access, rectification, erasure, restriction, portability, and objection. CCPA grants rights to know, delete, correct, and opt out of sale. The policy's acknowledgment that rights and timelines vary by jurisdiction is consistent with the differing requirements of these frameworks. Relevant enforcement authorities include EU national data protection authorities, the California Privacy Protection Agency, and state attorneys general. 2. GOVERNANCE EXPOSURE: Medium. The policy asserts broad global rights alignment but does not specify the timelines or mechanisms for fulfilling requests under each applicable jurisdiction. GDPR requires responses to data subject requests within one month (extendable to three months with notice), and CCPA requires responses within 45 days (extendable to 90 days). Compliance teams should confirm that Khan Academy's internal request fulfillment procedures meet applicable statutory timelines. 3. JURISDICTION FLAGS: EU and EEA users have directly enforceable rights under GDPR. UK users have equivalent rights under UK GDPR. California residents have rights under CCPA/CPRA. Other U.S. states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas, Montana) provide varying rights. The policy's statement that its ability to fulfill requests may be limited by service functionality should be evaluated against jurisdictions where such limitations may not constitute a valid basis for denial. 4. CONTRACT AND VENDOR IMPLICATIONS: Institutional users and B2B partners should confirm that their agreements with Khan Academy address data subject request fulfillment obligations, particularly for EU and EEA deployments where GDPR Article 28 requires data processors to assist controllers in fulfilling data subject rights requests within statutory timelines. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should map Khan Academy's stated rights fulfillment process against applicable statutory timelines for each jurisdiction in which their users are located. Identity verification requirements should be evaluated for consistency with applicable law, as some jurisdictions restrict the scope of verification that may be required before acting on deletion or access requests.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the range of privacy rights Khan Academy states it supports globally, which is operationally relevant for users in jurisdictions with enforceable privacy rights frameworks including GDPR, CCPA, and equivalent statutes. The policy acknowledges that its ability to fulfill specific requests may be limited by applicable law and service functionality.
Under this provision, users may request access to, correction of, deletion of, or objection to the processing of their personal information by contacting Khan Academy. The agreement acknowledges that specific rights and applicable timelines vary by jurisdiction and that Khan Academy may require identity verification before acting on requests.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Khan Academy.