1. Forum
  2. >
  3. Topic: Duolingo
  4. >
  5. Data Privacy & Duolingo: Welc…


Data Privacy & Duolingo: Welcome to the Drive-Thru

Over the next few weeks we’re introducing some changes to our Privacy Policy and adding new features to give you greater control over your personal data. We’re also launching a new portal that gives you the ability to access, download, export and erase your own data as needed — we call it the Duolingo Data Drive-Thru.

We take your privacy seriously and want to explain how we collect and use data at Duolingo. Most of the data we collect is for teaching and learning purposes and is essential to making Duolingo personalized and effective for each user. But as a free, ad-supported product, we also use third-party platforms to show ads that help keep Duolingo free for everyone.

Lately we have been busy implementing changes in response to the General Data Protection Regulation (GDPR), a new set of rules from the European Union (EU). Although GDPR primarily applies to users in the EU, we’ve decided to proactively extend the same protections to all of our users globally.

How can you manage your data?

The Duolingo Data Drive-Thru is a new portal where you can manage all of your data. The Drive-Thru lets you access all of your data, download it, request data erasure, and request account deletion. The Drive-Thru gives you more control over your personal data.

What kinds of data does Duolingo collect and how do we use it?

1. Teaching & Learning

The main type of data we collect is directly related to teaching and learning. We collect data on what languages a user is learning, what skills and lessons a user has completed, and word strength (i.e. which words a user has proven to know). This also includes data on when the user uses Duolingo, how many lessons they complete, and what in-app purchases they make.

Our research team uses this data in aggregate to help improve our courses and how we teach.

2. App Performance

We also collect data that we use for app performance purposes, like what type of device you’re using, your system software version, and what version of the Duolingo app you’re using.

This type of data is used for crash and bug reporting and fixing and helps ensure the best user experience. For example, when we release new updates to the app, we use this data to monitor any crashes that may occur so we can fix them before they impact anyone else.

3. Advertising

For advertising, we work with external companies that show their ads in Duolingo. Duolingo does not choose the ads you see in the app. These ads are chosen by third-party companies (like Google, Unity, and Facebook). You can see and control the type of information these advertising companies have access to by visiting their data privacy controls. Google | Facebook.

These ads are vital for supporting Duolingo’s mission of providing free education to everyone.

4. What we don't do

We don’t sell your personal data to third parties. We do not use the microphone permissions on your mobile device for anything other than speaking exercises in our courses. If it seems like you’re seeing ads in Duolingo for products or things you’ve searched for, that’s because our third-party ad serving partners like Google and Facebook collect this type of information about you outside of Duolingo.

You can visit our Help page at any time if you need to access this information in the future. For further details, please read our full Privacy Policy.

May 25, 2018



We are working on gathering up all your personal information that we have stored. When we are done you will receive an email with instructions for how to download the resulting zip file. Please note this can take up to 30 days.

30 days?!? WT... How much data does Duo have on me? =)


My two cents…

It's probably a lot of data but not that much. They're probably afraid a lot of people will ask for it in the first days and they don't want to overload their servers (causing performance issues for the courses) so they put it at a low priority and give a long delay knowing it will probably be much less but they want to be sure to keep up on their word.


Which, if I understand GDPR (General Data Protection Regulation) correctly, is against the law :D Putting it at a low priority, I mean. By the way, GDPR entered into force May 25 - I've been getting emails for weeks from all service providers in the EU, it's interesting that Duolingo just made the announcement now.


Actually GDPR was voted more than 2 years ago and the first proposal was made 6 years ago.

So, it's also interesting that all those service providers made the announcement only these last weeks.


It is, indeed :D However, based on my experience, companies won't comply with a law until it is actually applicable. Just because it was adopted two years ago, doesn't mean that they "have to" do anything about it until it's actually enforceable :p I do admit it would have been nice to get these emails throughout the two years and not all of them in the past few weeks - my inbox was clogged with GDPR messages :(

Edit: On the other hand, this regulation changes nothing and the emails from companies just give the illusion that our data is protected, so... the old adage of "when you use a service for free, you're the product being sold" is still valid. I just read an article about how Big Data companies (Google, Amazon and such) can actually determine how much money you have, so they can tailor the prices of products you purchase online to your purchasing power (i.e. you pay more for the same product if you have more money - funny, it doesn't work the other way around, you don't pay less if you're broke).


I think things speeded up when Mark Zuckerberg of FB was hauled before the US Congress.

Your faith in the willingness or even ability of the US Congress to put consumers first is touching. But even after the PR storm that happened when people found out what FB allowed Cambridge Analytica to do, Zuckerburg is still equivocating about allowing US users of FB to have the same degree of protection that they will have to give users in the EU. (And even in the EU, FB will be dragged kicking and screaming into compliance, rather than making a virtue of figuring how to maximize individual privacy while still delivering a compelling service that people want to use, rather than being solely focused on delivering eyeballs to advertisers).

The changes that FB actually implemented in recent weeks were a response to EU regulation, and the only real difference that the appearance before congress made was that some of those new tools will be available to users who don't have the legal protection of the GDPR.


And Mark Zuckerberg also had to answer before the European Parliament last week.

Zuckerberg appeared before a committee of the European Parliament a few days ago. By all accounts, "answering" was not high on his list of priorities, and he managed to avoid giving straight answers to many of the questions that were put to him.


And Mark Zuckerberg also had to answer before the European Parliament last week.


sliotar1 - I agree.


I think things speeded up when Mark Zuckerberg of FB was hauled before the US Congress.


GDPR gives a company up to 30 days to respond to a request, so it wouldn't be surprising to see a company's printed policy state this time period as a maximum limit. However, I believe there's also language in there saying the response should be in a reasonable amount of time - they're just putting 30 days as a limit on what's considered reasonable.


They know all about your job "not working for the CIA", Jersebas


It's now changed to several days


After all maybe this 30 days thing is true.

It’s now been about 10 days and I haven’t received anything yet…


So, the 30 days delay since I requested to access all my personal information on Duolingo has expired about 2 hours ago and I still haven't received anything…


Interesting - this thread is 30 days old now, and there haven't been any posts about what is contained in these reports.

Has anyone received as response to one of these requests yet?


I requested my data the day this was posted, and I got an answer on June 16th. It's a mail with the title "Duolingo personal data ready for download". It contains a download link, and you have to be logged in to get the data.


I just received it today, so after 31 (!) days…

[deactivated user]

    Agree, duolingo shouldnt take 30 days to do this.


    According to the GDPR, they have to fulfill this kind of request within 30 days. That's why they say it "can take up to 30 days". The actual time depends on how many people request their data and how many people they have working on these requests. And of course they are not going to promise you the data for a specific date - in case they miss it.


    My email is filling up with these privacy updates lately from different services. Everyone is changing their privacy and policies. Whats going on? Is it because of recent facebook incident ?

    • 1253


    No, it's just a coincidence that the recent FB incident blew up just before the new GDPR came into effect lon May 25th.


    One little step closer to transparency with user data, account deletions AND user-base figures. Long overdue.

    Drive-thru also allows you to fully delete your account (not deactivate). But this is a double-edged sword as according to the T&Cs of this site they seem to have more rights to the data of 'deleted' accounts than active ones. I wonder if this will change too?

    Of using active (and 'deactivated') user's data it states...

    Duolingo may use or share aggregate or anonymous data collected through the Service, including Activity Data, (only) for purposes such as understanding or improving the service.

    But of the data of 'deleted' users it seems to claim more right...

    After your account is deleted we will retain aggregate or anonymous data collected through the Service, including Activity Data, which may be used by Duolingo and shared with third parties in any manner.

    • 1253

    While your IP address may be considered personal or identifiable data, the fact that Duolingo has seen 100,000 different users connect from the same range of IP addresses as your IP address is "aggregate or anonymous" data. Duolingo may share the fact that over 100,000 users have logged into the service from the block of IP addresses that your ISP uses even after you delete your account.

    The fact that an IP address in your ISPs allocation was used to connect to the service will still exist, but only as "aggregate and anonymous" data.


    You should not be concerned about this type of data. It refers to information such as how many people learn a specific language, the average xp earned per day of all users or a specific user group, etc. It allows DL a statistical usage analysis of various aspects.

    It does not contain any data that can be traced back to you personally.


    For advertising, we work with external companies that show their ads in Duolingo. Duolingo does not choose the ads you see in the app. These ads are chosen by third-party companies (like Google, Unity, and Facebook). You can see and control the type of information these advertising companies have access to by visiting their data privacy controls. Google | Facebook.

    You have to have a Google account to access the Google Data Privacy controls, and a Facebook account to access the Facebook Data Privacy controls. I don't have a google or a facebook account, so I can't access the Google or Facebook Data Privacy controls, yet they are still tracking my activity in this browser, and they are still placing ads on Duolingo pages.


    You can go to http://optout.aboutads.info/ and opt out of personalized ads and such behavioral data collection for over 130 ad services, if that is what you mean.


    Have you ever actually tried to do that? Apart from the fact that the GDPR requires companies to provide access to the information held, and this "opt in to privacy" process doesn't do that, the last time I tried to use the aboutads.info process, 70 of the 130 "partners" failed to set their "flag this browser for special attention" cookie.


    Talk about how much a company values the information of their users over the users themselves, Hah.

    It didn't surprise me, it just was a fun show to see that number honestly



    I don't know much about any of this stuff. I believe the data collected from the browser is still not in Duolingo's control, as it is not Duolingo's browser. I'm using Chrome, which I think is Google's browser. I could be wrong.


    Duolingo is working "with external companies that show their ads in Duolingo". Duolingo says "You can see and control the type of information these advertising companies have access to by visiting their data privacy controls."

    This isn't true if you don't have a google or facebook account, and Duolingo is facilitating this. Now Duolingo isn't any worse than any other company on the internet in this regard, but this is Duolingo's statement, not some other company, and these ads are being shown on Duolingo's pages.


    Thanks sliotar1!


    That sounds reasonable and reassuring.


    And required in the EU under new data protection laws.


    I was just about to point this out, thanks!

    (My dad's a network engineer and is super careful about data protection stuff, and security.)


    "Stuff" is uncountable, and never plural. (Just a quick language tip, since this is a language site. Hope you don't mind.) ;-)


    Thanks! I'll change it. I just-- it's kind of a habit, I pluralize things.

    And everyone corrects me on it.

    I'll change it, thank you for letting me know! :)


    Thanks for the info! Hmm, I wonder how this will affect duome.eu.


    Exactly what I think.



    1. It is required that the information has to be "easily understandable". So far the information is only available in English, therefore not easy to understand for people with other native languages. Do you intend to translate the information soon, at least to the languages spoken in Europe which are supported by Duolingo?

    2. The link to the help center is not available with German as a base language. Do you intend to change that?

    3. Will the link to "deactivate your account" be replaced with another button in the profile? Right now I do not see how to erase my data or get access to the data via my profile.


    Very interesting -- thank you very much, HelpfulDuo and friends! :-)


    How about the data in "Tinycards" ?

    Tinycards is also part of Duolingo isn't it ?

    Will I be able to access / download / erase the Tinycards data ?


    If it seems like you’re seeing ads in Duolingo for products or things you’ve searched for, that’s because our third-party ad serving partners like Google and Facebook collect this type of information about you outside of Duolingo.

    Or, if you're like me, Just use Adblock and don't worry about it anyways.


    Adblock is one option. But, if everyone uses it, Duolingo stops existing. Duolingo does not get any funds from blocked ads. Just wanted to point that out for anyone who doesn't realize.


    Adblock has a setting that allows you to choose which sites display ads. So if someone wanted to block ads while supporting Duolingo that is possible.


    Adblock also allows you the option to keep acceptable ads. In such cases, provided the ads are following the reasonable guidelines, they wouldn't be blocked. If they're not, then they are deliberately being objectionable and Duo would deserve to lose that income.


    Hyacinth3704, ads are based on the browsing history of the device a person is using. Duolingo doesn't select the ads. If you see an objectionable ad, you can report it to Duolingo who will report it to Google, as the ads are coming from Google.


    I understand that. However, Duolingo does control which companies they work with. And if they work with companies that serve intrusive and/or objectionable advertising, they would deserve to lose that income.


    But, maybe you should look into Brave. You could make micro payments to Duolingo without having to see their ads.


    As far as I am aware, there are no Duolingo "micro-payment" plans. Only Plus memberships.


    For Duolingo to receive money from Brave they have to work with them. As far as I know they aren't.


    Can you edit the post to tell more specific details on exactly how it works? I'm sure i'm not the only one who's curious about this...


    Hello Jonathangrant00 What is Adblock? How do you get it?


    Adblock literally blocks ads and pop-ups and often prevents them being downloaded, so you don't see most ads when browsing the web if you have Adblock installed in the browser you're using.

    You can get it here: https://getadblock.com/ or by searching extensions/ad-ons etc of your browser.

    However, many companies rely on advertising as a main part of their income, so some websites will tell you to consider changing your Adblock settings so that it doesn't block ads on their specific website domain, and some websites will block you completely if you block their ads.

    Duolingo can offer a free service because they gain revenue from ads, so I use the 'Don't run on pages on this domain' set up for Duolingo, which doesn't have very invasive ads anyway. It's a one-time setting so requires no effort on my part, I am using it on Google Chrome.

    For less official websites, ads can be overwhelming, so my Adblock is on by default unless the situation calls for allowing ads on a certain website.


    Same, I leave it off of Duolingo because I was on here from before there were ads and still prefer it that way. I probably should turn it off though.


    I haven't had it that long and it has already blocked over 10 thousand ads. Thats 10,000 ads I never have to think about again. Sometimes ads can be inappropriate and I have no desire to see those so, Adblock is a great deal. Also, consider giving them a donation for what they do.


    this turned into a political argument really fast lol


    it IS a political argument !


    Well, data privacy in general is always a touchy subject. Also bringing the EU into this... my teacher calls it socialism, so, yes, it's pretty political, tbh


    I think you're leaving something out. When your teacher called it "socialism", did you assume that that was a good thing, or a bad thing?

    As for "bringing the EU into this" - the thread is about new policies that Duolingo has introduced to comply with new EU privacy regulations. The EU isn't being "brought into this", the thread wouldn't exist if it wasn't for the EU.

    If your teacher used the label "socialism" as a shorthand for "bad", as in "socialism is bad, the EU is socialist, therefore the EU laws on personal privacy are bad", you owe it to yourself to get a better teacher. And if you can't do that, at least find out what your teacher thinks "socialism" actually means, and whether that the EU really is socialist by that definition, or is it just a bogeyman that you're supposed to oppose without understanding why.


    Oh no-- my teacher is much too conservative for my taste. Yes, he uses it in a bad manner-- I just was using an example of it being used in a (over-)politicized example. I totally agree with you-- I'm just homeschooled and he's one of the only ones who teaches AP History in my area (that isn't college level.) Also, he's really nice, I just disagree with him on a bunch of things :)

    "As for "bringing the EU into this" - the thread is about new policies that Duolingo has introduced to comply with new EU privacy regulations. The EU isn't being "brought into this", the thread wouldn't exist if it wasn't for the EU"

    No, I meant like, I was bringing the EU into this in my comment. Like, the EU is highly politically debated, so I'll bring it in here too along with the touchiness of data privacy, to prove my point that it IS a political issue. Does that make sense? Sorry, I was super unclear.


    Did someone say "Drive-Thru". . . I would like all my data, some onion rings, and a large orange drink. ;-)



    yall are smart this makes me feel dumb


    I now downloaded and viewed my all personal data. Am I correct that no daily xp data is recorded? I can only find active days in a course and date of last activity of a course.


    I requested my data in the 14th of June but so far I received nothing, is there a problem?


    Given the report from Privacy International about DL sharing data with Facebook, to which DL responded by saying this would be redressed in the next update, my question is: when is the next update coming, please?

    Learn a language in just 5 minutes a day. For free.