Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy enumerates the circumstances under which personal information may be disclosed to third parties, including service providers, school personnel, account-associated users such as parents or coaches, third-party applications chosen by the user, parties in business transfer transactions, and for legal compliance purposes.
This analysis describes what Khan Academy's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the full scope of third-party disclosure that the agreement permits, including disclosure to parties in mergers and acquisitions and to third-party applications chosen by the user, whose own privacy policies govern subsequent use of that information. The merger and acquisition disclosure provision is standard but operationally relevant because it authorizes disclosure without individual user consent in that context.
Under this provision, the agreement authorizes disclosure of personal information to vendors and service providers acting on Khan Academy's behalf, account-associated users such as parents and teachers, schools for school-purpose accounts, user-selected third-party applications, and parties in connection with mergers or acquisitions. For third-party applications chosen by the user, the third party's own privacy policy governs the use of that information.
Cross-platform context
See how other platforms handle Disclosure of Personal Information to Third Parties and similar clauses.
Compare across platforms →Monitoring
Khan Academy has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We may disclose personal information: with other users of our Service, if you use features that enable you to share your information with (or make it accessible to) others. with vendors, consultants and other service providers working on our behalf with other users that are associated with your account, such as a parent, teacher or coach. with your school, if you are using our Service for school purposes (please see Schools and Student Use for more information). with your consent (including third party applications that you choose to use, such as complementary services or an Authentication Service). If you choose to use a third party application or service, the use of your information by the third party will be governed by that party's privacy policy. in connection with business transfers (due to mergers and acquisitions). for compliance purposes, such as when reasonably necessary to protect the security and safety of our users or Service, or when required or permitted by law.Excerpt from Khan Academy's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR's requirements for lawful basis and data processing agreements with third-party processors (Article 28), CCPA's service provider and business transfer disclosures, COPPA's restrictions on disclosure of children's personal information to third parties, and FERPA's restrictions on disclosure of student education records. The FTC, state attorneys general, and the U.S. Department of Education hold relevant enforcement authority. 2. GOVERNANCE EXPOSURE: Medium. The disclosure to user-selected third-party applications is operationally significant because the policy states that such disclosures are governed by the third party's own privacy policy, effectively transferring data governance responsibility to the third party upon user consent. For child and student users, this type of disclosure may be subject to additional COPPA and FERPA restrictions that limit the effectiveness of general user consent. 3. JURISDICTION FLAGS: EU and EEA users require a GDPR-compliant lawful basis for each category of third-party disclosure. COPPA restricts disclosure of children's personal information to third parties without verifiable parental consent. FERPA restricts disclosure of student education records without school authorization. California's CCPA imposes service provider contract requirements for disclosures to vendors. 4. CONTRACT AND VENDOR IMPLICATIONS: The policy's reference to service providers working on Khan Academy's behalf requires that those providers operate under contracts with appropriate data use restrictions consistent with GDPR Article 28 and applicable state law. The merger and acquisition disclosure should be evaluated in the context of any institutional data processing agreements to confirm whether change-of-control provisions are addressed. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a current list of third-party service providers receiving personal information under this provision and confirm that data processing agreements are in place. For school accounts, disclosure practices should be evaluated against FERPA's school official exception requirements and applicable state student data privacy laws. The policy's treatment of user-selected third-party application disclosures as consent-based should be evaluated for adequacy under COPPA and GDPR for child and EU users respectively.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the full scope of third-party disclosure that the agreement permits, including disclosure to parties in mergers and acquisitions and to third-party applications chosen by the user, whose own privacy policies govern subsequent use of that information. The merger and acquisition disclosure provision is standard but operationally relevant because it authorizes disclosure without individual user consent in that …
Under this provision, the agreement authorizes disclosure of personal information to vendors and service providers acting on Khan Academy's behalf, account-associated users such as parents and teachers, schools for school-purpose accounts, user-selected third-party applications, and parties in connection with mergers or acquisitions. For third-party applications chosen by the user, the third party's own privacy policy governs the use of that …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Khan Academy.