Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
Udemy's privacy policy governs how the platform collects and uses personal data from learners, instructors, and visitors across its online course marketplace and mobile apps. The policy authorizes collection of identifiers, browsing and course activity data, device information, and payment details, and permits sharing of this data with advertising, analytics, and business partners, including for targeted advertising purposes. California residents and EU users are granted specific rights including access, deletion, and opt-out of data sale or sharing for cross-context behavioral advertising, exercisable through account settings or a designated privacy request process.
This document is Udemy's privacy policy governing the collection, use, storage, and disclosure of personal data by Udemy Inc. and its affiliates across the udemy.com platform and associated mobile applications, establishing the legal basis for data processing under applicable frameworks including GDPR, CCPA, and FERPA where relevant. The policy states that Udemy collects identifiers, device information, course progress and activity data, payment information, communications content, and usage analytics, and the terms authorize sharing of this data with advertising partners, analytics providers, payment processors, corporate affiliates, and third-party service providers. The policy reserves the right to use personal data including learning activity and behavioral data for personalization, marketing, and platform improvement purposes, and the terms authorize cross-context behavioral advertising subject to opt-out mechanisms disclosed for California residents. The policy engages GDPR for EU and EEA users, CCPA and CPRA for California residents, FERPA for educational records contexts involving institutional customers, and FTC Act consumer protection standards; applicable law in these jurisdictions may constrain certain data uses asserted in the policy beyond what the document text alone establishes. Material compliance considerations include the scope of data sharing with third-party advertising and analytics partners, the adequacy of consent mechanisms for cross-border data transfers, and the policy's application to Udemy for Business enterprise accounts where institutional data handling obligations may differ from consumer-facing terms.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial3 important changes detected
4 versions captured · Last updated: May 2026
The Udemy Privacy Policy was updated on April 19, 2026, with one sentence modified in the document footer. The update changed the stated last-updated date from April 21, 2026 to …
View change record →New provision addressing what categories of personal data are collected, indicating expanded transparency requirements around data collection practices.
New provision establishing explicit GDPR compliance and EU/EEA user rights, representing heightened regulatory focus on European data protection.
New dedicated provision on tracking technologies, suggesting clearer disclosure of cookie usage and tracking consent mechanisms.
Removal of explicit M&A data transfer disclosure may indicate integration into broader data handling provisions or reduced transparency around transaction-related data transfers.
Removal of specific DPF certification language may indicate outdated framework reliance or integration into the new GDPR provision, potentially obscuring international data transfer compliance mechanisms.
Removal of explicit children's privacy protections and age restriction (16+) disclosure reduces transparency about child data handling and removes direct contact information for privacy concerns.
Removal of explicit instructor data access disclosure reduces user clarity about what learning data is visible to instructors within the platform.
Severity escalated from medium to high, and excerpt content removed from current version (text not provided).
Provision name updated from 'California CCPA/CPRA Rights' to 'California Resident Privacy Rights (CCPA/CPRA)' and excerpt content removed.
Excerpt content removed in current version while maintaining the same provision name and severity.
Provision renamed from 'Udemy Business Employer Data Sharing' to 'Udemy for Business Data Handling' and severity reduced from high to medium with excerpt removed.
Monitoring
Udemy has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle Behavioral Advertising Data Sharing and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.