{
  "slug": "canva",
  "category": "creative-tools",
  "name": "Canva",
  "description": "An online design platform for creating graphics, presentations, documents, videos and websites from templates, with AI features and team collaboration.",
  "website": "https://www.canva.com",
  "license": null,
  "platforms": [
    "web",
    "windows",
    "macos",
    "ios",
    "android"
  ],
  "jurisdiction": {
    "code": "AU",
    "name": "Australia",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "agreement"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 10,
  "coverage": 100,
  "summary": "Canva scores 10 out of 100 (grade F) on the creative tools criteria. It partly meets independent audit. It does not meet open source, no trackers or telemetry and no ads or data sales. It is based in Australia: Five Eyes member; CLOUD Act data access agreement with the US.",
  "url": "https://privacyratings.com/creative-tools/canva/",
  "markdown": "https://privacyratings.com/creative-tools/canva/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://www.canva.com/policies/privacy-policy/",
      "note": "Uses third-party analytics tools and ad networks such as Facebook, Google, LiveRamp and Taboola. User content and activity may be used to train AI unless turned off in privacy settings."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "no",
      "evidence": "https://www.canva.com/policies/privacy-policy/",
      "note": "The privacy policy describes personalized ads with partners such as Facebook, Google, LiveRamp and Taboola, on the service and other sites."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://www.canva.com/security/",
      "note": "Lists ISO 27001, SOC 2 Type II and SOC 3 audits, but the full reports are not public."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "n/a",
      "evidence": null,
      "note": "Only applies to hosted services with a website to test."
    }
  },
  "tests": {
    "ssllabs": null,
    "observatory": null,
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": null,
    "tested_at": "2026-10-01T07:00:18.893Z"
  },
  "last_modified": "2026-10-01T07:44:20Z"
}