"Canva presents a high-risk privacy profile comparable to Google/Microsoft due to extensive automatic data collection (precise location, device identifiers, browsing history, email tracking), aggressive third-party sharing including AI training partnerships with OpenAI, and sophisticated cross-site behavioral tracking via cookies, pixels, and device IDs for ad targeting. The vague data retention policy, organizational account access without granular user control, and heavy reliance on legitimate interest as a legal basis for tracking further elevate risk. While opt-out mechanisms exist, they are scattered across the interface and require proactive user action, placing the burden on consumers rather than Canva to protect privacy."
canva Privacy Concerns & Scorecard
Canva shares user data with OpenAI for AI training purposes via 'Canva AI products' without explicit per-content consent. The policy states data is shared 'for purposes including data storage, analytics, user support, email communications, error monitoring, and AI products' but does not clearly specify what content is used or provide granular opt-out.
Canva employs sophisticated cross-site behavioral tracking via cookies, pixels, tags, device identifiers, and email matching with third-party ad networks. Tracks websites visited before coming to Canva to determine advertising effectiveness, and uses machine learning for predictive profiling.
Canva collects an exceptionally broad range of personal data including precise location tracking, device identifiers, browsing history, email open tracking, and all user-generated content (designs, images, videos with metadata). This goes far beyond what is necessary for a design platform's core functionality.
Canva shares personal data with 21+ third-party service providers including OpenAI for AI training, ad networks (Facebook, Google, LiveRamp, Taboola), and data enrichment partners. Sharing occurs across social media platforms (Facebook, Instagram, TikTok, LinkedIn) without granular user control.
Public designs are globally searchable and indexed by search engines; cached/archived copies persist indefinitely after deletion, meaning user content cannot be fully removed from the internet once published.
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, authentication, contact, communication, employer/organization verification, product personalization, and profiling.
Personalization, advertising targeting, analytics, and service improvement.
Cross-device tracking, behavioral profiling, analytics, advertising attribution, and device-level targeting.
Service improvement, personalization, analytics, machine learning model training, advertising targeting, and predictive analytics.
Service delivery, storage, backup, analytics, machine learning training for AI products, generating insights, and product development.
Marketing, customer support, email analytics, behavioral targeting, and engagement measurement.
Account linking, social sharing, audience enrichment, advertising targeting, and cross-platform profiling.
Billing, subscription management, analytics, and business intelligence.
Advertising effectiveness measurement, targeting optimization, attribution, and campaign analytics.
Cross-Platform Tracking
Canva tracks you across the internet using cookies, pixels, device identifiers, and email matching with third-party ad networks. The policy explicitly states Canva 'tracks websites visited before coming to Canva to determine advertising effectiveness' and partners with ad networks to 'track users across the Service and other websites including Samsung televisions.' Email addresses are matched against third-party data providers (LiveRamp, data brokers) to combine profile data from cookies, pixels, and tags for targeted advertising.
Tracking Methods:
Cookies
HTTP cookies stored in browser to track user identity, preferences, session data, and browsing behavior across Canva and third-party websites.
Tracking Pixels / Clear GIFs
Invisible 1x1 pixel images embedded in web pages and emails to track page views, email opens, click-throughs, and user activity without user awareness.
JavaScript Tags
JavaScript code snippets that collect data about user behavior, clicks, form submissions, and page interactions; used by analytics and ad networks.
Device Identifiers
Unique device-level identifiers (UUID, Android Advertising ID, IDFA) that persist across apps and sessions to enable cross-device tracking and profiling.
Email Matching / LiveRamp
Email addresses matched against third-party data provider networks (LiveRamp) to combine data from cookies, pixels, and tags for audience enrichment and targeting across the web.
Third-Party Ad Networks
Facebook, Google, Taboola, Outbrain, AppsFly, and other ad networks track users across Canva and their partner sites to serve retargeted advertisements based on browsing history and behavioral profiles.
Social Media Pixels
Facebook, Instagram, TikTok, LinkedIn, and Twitter tracking pixels on Canva's site to capture user actions and build audiences for social media advertising.
Server-Side Analytics
Backend logging of API calls, user actions, design creation, collaboration events, and feature usage tracked via Amplitude, Looker, Mode, and other analytics platforms.
Terms of Service Updates
Effective Date Updated
The Terms of Use effective date has been changed from 20 July 2026 to 19 August 2026. This is a routine update indicating the document has been revised.
Effective: August 19, 2026
AI & Data Training
canva uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Designs
User-created designs, images, documents, and visual content
Prompts & Text Input
Search queries, prompts entered into AI features, and text provided by users
Content Metadata
Associated metadata, design choices, templates used, and usage patterns related to content
How to Object
You can submit an objection using the steps below.
- 1
Log in to Canva, navigate to Settings > Privacy, find the 'AI Training' or 'Machine Learning' section, and toggle OFF to opt out of using your designs and content for AI model training. Alternatively, email privacy@canva.com to request opt-out. Note: This protection is automatic for Canva Education accounts but must be manually enabled for regular accounts.
Why We Analyzed canva
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.