Skip to content

California Privacy Notice

The previous snapshot of Instructure's California Privacy Notice recorded no text, so there is nothing to compare this capture against — the diff shows the whole notice arriving on the new side only. We therefore cannot say what, if anything, changed in the words themselves; the notice's own "Last Updated 20 September 2023" stamp suggests the document predates both checks, but that is an inference, not proof, and the prior snapshot label implies an earlier revision existed whose content simply is not shown here. What we can report is what the notice now says, since for many readers this is the first time the full text is on record: Instructure sells or shares California residents' names, email addresses, online identifiers, browsing and search history, and behavioural inferences with advertising networks, marketing data companies and social networks, and offers a "Do Not Sell or Share My Personal Information" opt-out.

Your identifiers, browsing history and behavioural inferences are sold or shared with advertisers (pre-existing, shown here for the first time)The notice says Instructure sells or shares your name, email, online identifiers, browsing…

The notice says Instructure sells or shares your name, email, online identifiers, browsing and search history, and inferences about your predicted characteristics with advertising networks, marketing data companies, social networks and other outside companies. This is almost certainly not new — the document dates itself September 2023 — but the previous snapshot held no text, so this is the first time it appears on record here, and it is worth knowing about. Severity is low because it is being disclosed rather than newly introduced, and a free opt-out is offered.

“We sell or share the categories of personal information designated above to the categories of third parties listed below:”

What you can do — If you are a California resident, use the "Do Not Sell or Share My Personal Information" link at https://instructure.com/policies/california-opt-out, or email privacy@instructure.com or call 1 (800) 203-6755. Note that data handled through your school's or employer's Instructure products is not covered — for that, contact the school or employer directly.

DATA SHARING
20260811_rev01COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED
1**_Last Updated 20 September 2023_**
+ ADDEDFull notice text captured for the first time

The earlier snapshot stored no text for this document, so this capture is the first full copy on record. Because there is no earlier text to line up against, we cannot tell whether any wording changed between the two checks. The notice dates itself 20 September 2023, which suggests it was written well before either check.

2
3This California Privacy Notice ("CA Privacy Notice") contains disclosures required by the California Consumer Privacy Act ("CCPA") and applies only to California residents.
4
5This Privacy Notice describes Instructure's collection, use, and disclosure of personal information as defined in the CCPA, as well as your rights with respect to that personal information. It applies when Instructure is acting as a "business" as defined by the CCPA, for example, when we collect personal information through our corporate websites, and it pertains to and supplements the [Instructure Marketing Privacy Policy](https://instructure.com/policies/marketing-privacy).
6
7Instructure also processes personal information through our products on behalf of our customers, in order to provide services to our customers. Under the CCPA, when Instructure acts on behalf of its customers, Instructure processes personal information as a "service provider," a designation which is not subject to the disclosures and rights set forth in this Privacy Notice. To exercise your rights with respect to that personal information, you must contact the relevant Instructure customer-for example, the school you attended or company you worked for when you used an Instructure product. Instructure will cooperate with that business to fulfill your request if they request that we do so. To learn more about how Instructure treats personal information when acting as a service provider, please view the [Instructure Product Privacy Policy](https://instructure.com/policies/product-privacy-policy).
+ ADDEDThis notice does not cover data handled for your school or employer

When Instructure runs a product for a school or company, it says it acts as a "service provider," and the rights in this notice do not apply to that data. To get at that information you have to go to the school or employer instead.

8
9Consumers with disabilities may access this notice by using a screen reader or contacting Instructure for further assistance.
10
111. **Personal Information We Collect, Disclose for a Business Purpose, and Sell.**
12
13In the past 12 months, we collected, disclosed for a business purpose, sold, or shared the following categories of personal information about California consumers.
14
15<table><tbody><tr><td><p><strong>Categories of Personal Information</strong></p></td><td><p><strong>Disclosed for business purposes to the following categories of third parties:</strong></p></td><td><p><strong>Sold or Shared with the following categories of third parties:</strong></p></td></tr><tr><td><p>Personal and online identifiers (such as first and last name, email address, or unique online identifiers)</p></td><td><p>All categories listed below.</p></td><td><p>All categories listed below.</p></td></tr><tr><td><p>Commercial or transactions information (such as products or services purchased, obtained or considered)</p></td><td><p>All categories listed below.</p></td><td><p>N/A</p></td></tr><tr><td><p>Internet or other electronic network activity information (such as browsing history, search history, interactions with a website, email, application, or advertisement)</p></td><td><p>All categories listed below.</p></td><td><p>All categories listed below.</p></td></tr><tr><td><p>Biometric information (such as call recordings)</p></td><td><p>All categories listed below.</p></td><td><p>N/A</p></td></tr><tr><td><p>Geolocation information</p></td><td><p>All categories listed below.</p></td><td><p>N/A</p></td></tr><tr><td><p>Professional or employment-related information</p></td><td><p>All categories listed below.</p></td><td><p>N/A</p></td></tr><tr><td><p>Education information</p></td><td><p>All categories listed below.</p></td><td><p>N/A</p></td></tr><tr><td><p>Inferences drawn from the above information about your predicted characteristics and preferences</p></td><td><p>All categories listed below.</p></td><td><p>All categories listed below.</p></td></tr><tr><td><p>Other information about you that is linked to the personal information above</p></td><td><p>All categories listed below.</p></td><td><p>All categories listed below.</p></td></tr></tbody></table>
+ ADDEDWhat data is collected, including biometrics, location and education records

The notice lists the categories of information Instructure says it collected about California consumers in the past 12 months: names and email addresses, purchase and transaction history, browsing and search activity, biometric information (it gives call recordings as the example), geolocation, work and employment details, education information, and inferences about your predicted characteristics and preferences.

+ ADDEDSome of that data is sold or shared with advertisers and social networks

For four categories — identifiers like your name and email, internet and network activity such as browsing and search history, inferences about you, and other linked information — the notice marks them as sold or shared with outside companies. The other categories, including biometric, geolocation, and education information, are marked "N/A" for selling and sharing.

16
17**Sensitive Personal Information**. We do not use or disclose sensitive personal information for purposes other than those specified in the CCPA.
18
19**Categories Of Sources**. We collect this personal information from the following categories of sources:
20
21- Consumers;
22- Advertising networks;
+ ADDEDWho receives the sold or shared data

The list of buyers and recipients includes advertising and marketing companies, advertising networks, marketing data companies, data analytics providers, social networks, business-to-business companies, and educational institutions and companies.

23- Analytics providers;
24- Businesses and education institutions associated with consumers;
25- Business partners;
26- Service providers; and
27- Affiliates not under the Instructure brand.
28
292. **Why We Collect, Use, Sell, and Share California Information****.**
30
31We use and disclose all categories of personal information we collect for our commercial and business purposes, as further described in the [Instructure Marketing Privacy Policy](https://instructure.com/policies/marketing-privacy). These commercial and business purposes for which we use and disclose these categories of personal information include, without limitation:
32
33Our commercial purposes, which include:
34
35- Personalized marketing and advertising, including sending surveys and promotional communications and soliciting feedback;
36- Enabling commercial transactions and sending administrative email;
37- Responding to requests made by consumers including to respond to comments and inquiries; and
38- Operating, maintaining, and improving our websites and services including personalization.
39
40Our business purposes as identified in the CCPA, which include:
41
42- Auditing related to our interactions with you;
43- Ensuring the security and integrity of our systems;
44- Legal compliance;
45- Detecting and protecting against security incidents, fraud, and illegal activity;
46- Debugging;
47- Performing services (for us or our service provider) such as account servicing, processing orders and payments, and analytics;
48- Internal research for technological improvement;
49- Internal operations;
50- Activities to maintain and improve our services; and
51- Other one-time uses.
52
53We sold or shared personal information to third parties for the following business or commercial purposes:
54
55- Analytics related to the use of the Site and marketing; and
56- Advancing our commercial or economic interests, including by marketing our product and services.
57
58We do not sell the personal information of minors we know to be under 16 years of age.
+ ADDEDNo selling of data about known under-16 users

Instructure states it does not sell the personal information of minors it knows to be under 16.

59
603. **Recipients Of California Personal Information.**
61
62We disclose the categories of personal information designated above to the categories of third parties listed below for business purposes:
63
64- Service providers;
65- Affiliates not under the Instructure brand;
66- Third parties at your request or direction;
67- Data analytics providers;
68- Partners; and
69- Social networks.
70
71We sell or share the categories of personal information designated above to the categories of third parties listed below:
72
73- Advertising/marketing companies;
74- Advertising networks;
75- Business services/agencies;
76- Business to business companies;
77- Marketing data companies;
78- Data analytics providers;
79- Social networks; and
80- Educational institutions & companies.
81
824. **Your Rights Regarding Personal Information****.**
83
84California residents have certain rights with respect to the personal information collected by businesses. If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:
85
86- The **right to know** the categories and specific pieces of personal information we collect, use, disclose, and sell about you, the categories of sources from which we collected your personal information, our purposes for collecting or selling your personal information, the categories of your personal information that we have either sold or disclosed for a business purpose, and the categories of third parties with which we have shared personal information;
87- The **right to correct inaccurate** personal information that we maintain about you;
88- The **right to request that we delete** the personal information we have collected from you;
89- The **right to opt out of our sale or sharing** of your personal information. Please note that if you opt out of certain types of sales or sharing, we will be unable to provide you with the services that rely on such sales or sharing; and
+ ADDEDYour California rights and how to use them

California residents can ask what data is held, correct it, delete it, opt out of its sale or sharing, and not be treated worse for asking. You can act by phone, webform, the "Do Not Sell or Share" link, or email. The notice warns that opting out may mean losing services that depend on that sharing.

90- The **right not to receive discriminatory treatment** for the exercise of the privacy rights conferred by the CCPA.
91
92To exercise any of the above rights, please contact us using the following information and submit the required verifying information, as further described below:
93
94- By phone at 1 (800) 203-6755
95- By accessing our webform at [CA Privacy Rights](https://instructure.com/policies/california-opt-out) link
96- By accessing our [Do Not Sell or Share My Personal Information](https://instructure.com/policies/california-opt-out) link
97- By email at [privacy@instructure.com](mailto:privacy@instructure.com)
98
995. **Verification Process and Required Information.**
100
101Note that we may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled. We will require you to provide, at a minimum, your full name, email address or other contact information, and information about your relationship with Instructure. If we cannot successfully verify your identity, or if the information would be too sensitive to disclose, we may not be able to provide the personal information to you.
102
1036. **Authorized Agent.**
104
105You may designate an authorized agent to make a CCPA request on your behalf by designating such an agent in writing or through a power of attorney. We will require the agent to provide us with proof that you have authorized the agent to make a CCPA request on your behalf prior to processing the request. We may request additional information to verify the request.
106
1077. **Changes to this CA Privacy Notice.**
108
109We may change this Privacy Notice from time to time. If we make any changes to this Notice, we will change the "Effective Date" above. If such changes are material, a notice of the changes will be posted along with the revised CA Privacy Notice. Once we update this CA Privacy Notice, the updates will be effective 7 days after the "Last Updated" date. We encourage you to visit this page from time to time for the latest on our privacy practices.
+ ADDEDChanges take effect 7 days after the date stamp

Instructure can update this notice and says updates become effective 7 days after the "Last Updated" date. The same section refers to changing an "Effective Date" above, but the document actually carries a "Last Updated" stamp — a small internal inconsistency in the text.

110
1118. **Contact For More Information.**
112
113For questions or concerns about Instructure's privacy policy or practices, please contact us at:
114
115Instructure, Inc.
1166330 S 3000 E, Suite 700
117Salt Lake City, UT 84121
118
119Phone: (800) 203-6755
120Email: [privacy@Instructure.com](mailto:privacy@Instructure.com)