SOURCE: https://privacy.commonsense.org/evaluation/canvas

Overview
Canvas by Instructure provides a cloud-based learning management system (LMS) that connects digital tools and resources for teachers. This evaluation covers the cloud based service offered by the vendor, not the open source codebase available on Github. The terms state Canvas collects a wide range of information about students from work submissions, assessment scores, content feedback, and learning tools. The terms state Canvas may sell users' data to third parties and displays targeted advertising, with some limited restrictions for students. The terms say Canvas may track and profile users on its site and across the internet on other sites and services for commercial purposes. In addition to its LMS, the terms state Canvas provides forums for users to post messages and respond to other user’s messages. Any forum posts or comments will show usernames, and any information posted by a user can be read, collected, and shared by others who access them.

Canvas can be accessed through its website. Canvas Teacher is available for download at the iOS App Store, and the Google Play Store. Canvas Student is available for download at the iOS App Store, and the Google Play Store. Canvas Parent is available for download at the iOS App Store, and the Google Play Store.

The Privacy Policy and Terms of Use accessed for this evaluation can be found on Canvas' website. Additional polices include: Data Processing Addendum and Security Program. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.

Safety
The terms of Canvas state they provide a learning management system (LMS) for students and teachers that includes forums for users to post messages and respond to other user’s messages. The terms state any forum posts or comments will show usernames, and any information posted by a user can be read, collected, and shared by others who access them. In addition, the terms state the Service may monitor or review a user’s interactions with other users and content.

Privacy
The terms of Canvas state they collect personal information about a student and teacher to provide its cloud-based learning management system (LMS) to teachers and schools. The terms state the Service collects a wide range of information about students from work submissions, assessment scores, content feedback, and other learning tools. The terms state Canvas may sell users' data to third parties and displays targeted advertising, with some limited restrictions for students. The terms say Canvas may track and profile users on its site and across the internet on other sites and services for commercial purposes. In addition, the vendor uses de-identified data and anonymized data for its own internal purposes. The terms specify that Canvas may share de-identified and aggregated data with other third parties.

Security
The terms specify that Canvas takes reasonable steps to help protect a user’s personal information from unauthorized access, use, or disclosure. The terms specify that users must notify the vendor immediately of any unauthorized use of their password or any other breach of security. In addition, the terms provide detailed information about security, data protection practices, and breach notifications.

Compliance
The terms of Canvas do not say whether they provide a special child or student account is available for users under the age of 13. However, the terms do specify users are able to access, update, review, or delete their personal information at any time. The terms do not discuss any specific student data privacy protections and teachers should review their school policies before use.

This product received a Warning rating based on the following details:
Personal information is sold or rented to third parties.
Personal information is shared for third-party marketing.
Personalised advertising is displayed.
Data are collected by third-parties for their own purposes.
User's information is used to track and target advertisements on other third-party websites or services.
Data profiles are created and used for personalised advertisements.