Duolingo is a language learning application that users can access without paying subscription fees. Duolingo offers a consumer and a "for schools" version, and both applications are governed by the same privacy policy. Duolingo's terms say they allow users to engage in social interactions through discussions with other individuals where they can send messages, but not for children under the age of 13. Duolingo's terms say they collect personally identifiable information and automatically collected usage information from users when they register an account.

Duolingo's terms do not say whether they sell user's data to third parties. However, Duolingo's terms do say they share users' data with third party advertising networks, marketing analytics service providers and website analysis companies. These third-party advertising services collect may use personal data to track users and display targeted advertisements on other apps and services across the internet. Duolingo's terms also say they have implemented administrative and technical safeguards it believes are sufficient to protect the confidentiality, integrity and availability of a user's Testing ID, Photo, access credentials, and Duolingo language test results. Lastly, Duolingo's terms say users can access, modify, and delete their data at any time and that some features of the application are designed to be used by children under the age of 13.

Duolingo can be accessed through its website, and is available for download at the iOS App Store, and the Google Play Store. The Privacy Policy and Terms of Use accessed for this evaluation can be found on Duolingo’s website. Additionally, other policies used for this evaluation include: Community Guidelines. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.

Safety

Duolingo's community guidelines indicate that Duolingo ensures a safe environment for user interaction by removing inappropriate and offensive content, but some personal information may be publicly visible. However, Duolingo warns users not to overshare personal information when interacting with other users. The terms say Duolingo puts in place safety protections for children such as: a child’s profile is made private and hidden from other users’ searches and other users are unable to follow a child. In addition, the ability to follow other users or search for other users is disabled for children and the ability to send an invitation email is disabled and social logins with Facebook, Google or Apple are disabled.

Privacy

The terms of Duolingo say they collect personally identifiable information and automatically collected usage information from users when they register an account. If a user registers for a Duolingo language test, each time they take a test they must also provide a picture or scan of a current, valid driver’s license, passport or other government issued ID and a picture of their face. When a user takes an examination of a Duolingo language test they must provide access to their computer’s webcam and microphone. Duolingo's terms say they will use them to record a user during the entire examination period and will store the recording to validate that a user took the examination without improper assistance.

Duolingo's terms do not say whether they sell user's data to third parties. However, Duolingo's terms do say they share users' data with third party advertising networks, marketing analytics service providers and website analysis companies. These third-party advertising services may collect and use personal data to track users and display targeted advertisements on other apps and services across the internet. Lastly, the terms say information associated with a Duolingo language test, including examination results and a user's Testing Video, may be collectively deleted from a user's Duolingo account, but anonymized examination data, including a user's examination results and Testing Video, may be kept indefinitely by Duolingo to improve the examination and for research and analysis.

Security

Duolingo's terms say they have implemented administrative and technical safeguards it believes are sufficient to protect the confidentiality, integrity and availability of a user's Testing ID, Photo, access credentials, and Duolingo language test results. However, Duolingo's terms do not provide any information about whether personal information is encrypted while in transit or at rest. Furthermore, there is no indication as to whether users will be notified in the event of a data breach.

Compliance

Duolingo is a service meant for all ages, and the service is clear that it does design some features specifically for children. However, the service would likely appeal to children under 13 years of age, which take into account several factors that include the educational related subject matter, visual content, the game-based features of the application, age of models or cartoons, and activities provided. The privacy policy indicates that users can access, delete, or modify their data by visiting their account settings or notifying Duolingo through email. Duolingo's terms also say they obtain parental consent before collecting personal information from children, both in the United States, the European Union, and other countries. Lastly, Duolingo says that it collects a parent's email addresses to contact parents and obtain consent for their children's account.

• Unclear whether personal information is sold or rented to third parties.
• Personal information is shared for third-party marketing.
• Personalised advertising is displayed.
• Data are collected by third-parties for their own purposes.
• User's information is used to track and target advertisements on other third-party websites or services.
• Data profiles are created and used for personalised advertisements.