Does Canva train on your designs? On Free and Pro it does by default with an easy opt-out; on Teams, Business and Enterprise, Canva states it does not use your content to improve its AI features, and the setting is locked off for now.
Plain-English risk rating: 3 of 5 (Free/Pro) / 1 of 5 (Teams/Business/Enterprise/Education with Canva Shield)
Canva's AI features (consolidated under the Magic Studio brand) sit within Canva's broader design platform with one of the cleanest training-default structures of any AI design vendor as of mid-2026. Canva’s Trust Center draws the line: for Teams, Business and Enterprise accounts the AI training control is disabled, and Canva says it does not use business, team or enterprise content to improve AI-powered features. It says an admin opt-in is “coming soon”. Education users can neither opt in nor opt out. Free and Pro accounts have training enabled by default in privacy settings with a user-controlled opt-out. The Affinity Studio path introduces a third category — if you create a Canva account via Affinity sign-up, your content is only used for training if you actively opt in.
The split rating reflects the structural difference: Free/Pro at 3 of 5 sits in the same band as ChatGPT consumer and Claude consumer (training on by default, opt-out exists), but Teams/Business/Enterprise/Education at 1 of 5 reaches the lowest-risk tier in this database because Canva states it does not train on that content and the control is locked off. Canva Shield IP indemnification for Enterprise customers (100+ seats) is among the most credible commercial-safety positions in the AI image generation category.
Recommended for
- Sole proprietor: Canva Pro at $14.99/month for regular work, with the privacy setting manually toggled to opt out of training. The opt-out is straightforward via Account → Privacy settings.
- Small team (2-10 people): Teams at $14.99/user/month (5-user minimum) with training off by default and the setting locked. This is the point where Canva moves from consumer-grade AI with an opt-out to a stated no-training position for business accounts. Strong value at this price point.
- Regulated industry: Enterprise tier with Canva Shield IP indemnification, team administrator controls for which Magic Studio features are enabled per role, and explicit policy guidance on what content classes are appropriate.
- The honest answer for most 1-10 employee businesses using Canva: Magic Studio features are useful productivity additions bundled with the platform you're already paying for. For any business use, Teams tier or higher is the right floor — the stated no-training default (a Trust Center position, not a contract term) at $14.99/user/month is meaningfully better than competing AI design tools at similar price points.
Critical pre-deployment warning (Affinity Studio sign-up path)
This is a subtle but important fact about the Canva ecosystem as of mid-2026: if you create a Canva account as part of the Affinity Studio sign-up process, your content is treated differently than if you sign up for Canva directly. Affinity-path content is only used to improve AI features if you actively opt in (rather than being opt-out by default on Free/Pro or opt-out-only on Teams+).
For SMBs migrating from Affinity to the Canva ecosystem (Canva acquired Affinity in 2024 and made it free for all users in 2025), this means the privacy posture depends on which sign-up path you used. If your team uses both Affinity and Canva, verify the privacy settings on each user's account rather than assuming they match.
Data retention default
- Standard Canva retention applies to designs and uploaded assets
- Magic feature retention varies per feature; Magic Write generated text saved as part of designs; Magic Edit and Magic Design generate previews that may have different retention
- LLM provider retention: Canva does not publish how long its AI technology partners keep your input. Its AI Product Terms say your input “may be shared with our Technology Partners” to provide the feature, and that your Privacy Settings control whether Canva and those partners “may use your data to improve our AI services for everyone”. (Corrected 2 October 2026: this previously said zero retention with LLM providers was the default on paid plans. Canva’s AI Product Terms (26 June 2026), Trust Center and Canva Shield page do not say so.)
- Per the AI Product Terms effective 26 June 2026: "As between you and Canva, and to the maximum extent permitted by applicable law, you retain your ownership rights to your Input, and you own your Output, except for any Output that modifies or incorporates Licensed Content", which is licensed to you separately.
Training opt-out
Free, Pro — TRAINING ON BY DEFAULT for user-controlled opt-out. Toggle at Account → Settings → Privacy.
Teams, Business, Enterprise, Education — NO TRAINING BY DEFAULT, SETTING LOCKED OFF. Canva’s Trust Center says the control is disabled on these accounts and that admin opt-in is “coming soon”. It is a stated position on Canva’s Trust Center, not a term we found in the AI Product Terms, so it can change. Corrected 23 October 2026: this section, the opening line, the plan table and four other lines described the position as contractual or permanent. Neither holds: the AI Product Terms do not state the tier rule (see Sources), and Canva says opt-in is coming. No rating moved.
Affinity-path Canva accounts — OPT-IN ONLY. Content from Canva accounts created via Affinity sign-up is only used to improve AI features if the user actively opts in.
Team administrator controls allow Teams/Business/Enterprise admins to manage which Magic Studio features are enabled per employee role, which is a useful additional control for organisations with mixed employee roles (e.g., marketing team uses Magic Write, customer-facing team does not).
Zero Data Retention availability
- No zero-data-retention commitment is published for any plan. (Corrected 2 October 2026: this previously said zero retention with LLM providers was the default on paid plans. Canva’s AI Product Terms (26 June 2026), Trust Center and Canva Shield page do not say so.)
- Canva publishes no retention period and no customer-configurable retention control for any plan, including Enterprise. Its Master Services Agreement has no retention clause, and its Data Processing Addendum says personal data is destroyed on termination, without a period. Canva Shield is an IP indemnification programme, not a retention term. (Corrected 4 October 2026: this previously said Enterprise customers could negotiate custom retention terms via a Canva Shield contract.)
Plan tiers and pricing (as of early 2026)
| Tier | Price (USD) | Training default | IP indemnification | Suitable for |
|---|---|---|---|---|
| Free | $0 | On by default; opt-out available | No | Personal use |
| Pro | $14.99/month | On by default; opt-out available | No | Individual professionals |
| Teams | $14.99/user/month (5-user min) | Off; setting locked (admin opt-in “coming soon”) | No (Enterprise feature only) | Small teams |
| Business | Custom (mid-market tier) | Off; setting locked (admin opt-in “coming soon”) | No (Enterprise feature only) | Mid-size teams |
| Enterprise | Custom (100+ seats) | Off; setting locked (admin opt-in “coming soon”) | YES — Canva Shield | Larger orgs needing IP indemnification |
| Education | Free for qualifying institutions | Off; users cannot opt in or out | No | Schools, universities |
Jurisdiction
- Primary processor: Canva Pty Ltd, Sydney, Australia (with US, UK, and EU subsidiaries)
- Cloud infrastructure: AWS primarily
- Third-party AI subprocessors: multiple providers under contractual arrangements per feature; specifics evolve as Canva integrates additional models
- SOC 2 Type II, ISO 27001 certified; GDPR-compliant
- Subject to Australian Privacy Act, EU GDPR, US state laws, NZ Privacy Act 2020 for NZ users
Breach history (public incidents)
May 2019 — Canva data breach (137 million users)
Canva disclosed a major breach in May 2019 affecting approximately 137 million user accounts. Stolen data included usernames, email addresses, names, cities, and hashed passwords. The breach pre-dates Canva's AI features but represents the platform-level threat baseline and the scale of attacker interest in Canva's user base.
Source: Canva official disclosure; ongoing security research coverage
No publicly-disclosed Canva Magic Studio AI-specific breach as of May 2026.
Reference point: November 2025 Figma class action
Not a Canva incident but directly relevant to the design-tool AI training category. Figma was named in a proposed class action filed November 21, 2025 in the Northern District of California alleging that Figma used customer design data to train its generative AI models without permission. The case is unresolved. The relevance to Canva: if Figma's plaintiffs prevail, the precedent would apply to any design tool that trained on user-generated design files without explicit consent. Canva's posture (training off by default and locked for Teams+, opt-out available for Free/Pro, opt-in for Affinity-path) is structurally better positioned than the Figma allegations describe, but the legal category is one to track.
Source: MEXC and other coverage of Figma class action filing (November 21, 2025)
Category-level risk: Magic feature processing involves uploading designs and assets to Canva and to third-party AI providers. The category-level prompt-injection risk for generative AI applies; the additional Canva-specific consideration is the breadth of content classes that pass through the platform (everything from personal social posts to confidential client design work). Canva has not had a publicly-disclosed major prompt-injection incident; the category risk is present.
What this means in plain English for SMB owners
Three honest takeaways:
- Canva's tiered training defaults are among the clearest in this database. Free and Pro: on by default, easy opt-out. Teams and above: off by default and locked, with admin opt-in “coming soon” according to Canva. This is structurally better than competitors who require Enterprise-tier contracting to achieve the same guarantee.
- For any business use, Teams tier or higher is the right floor. The $14.99/user/month price point is genuinely competitive for what you get — training off by default, administrator controls, shared brand assets. Free tier for commercial work means your prompts and inputs are training data unless you have manually toggled the opt-out, which most users have not done.
- The Canva Shield IP indemnification is meaningful for Enterprise customers but only at the 100+ seat tier. Most SMBs will not reach this threshold. For the 1-10 employee businesses this site is written for, the structurally relevant fact is that Magic Studio outputs can be used commercially on all paid tiers, with ownership explicitly retained by the user. The Figma class action is worth tracking as it could affect commercial-use rights across the design-tool category if plaintiffs prevail.
Sources
- Canva Privacy Policy, canva.com/policies/privacy-policy (last updated 25 August 2026; verified 2026-08-29). Note on sourcing: this document confirms that AI-training use can be managed in privacy settings and that Canva Education content is excluded, but it does not itself state the tier distinction our rating depends on. That claim is sourced to the Trust Center entry below.
- Canva Trust Center — Privacy, canva.com/trust/privacy (verified 2026-08-29). This is the operative source for the tier rule. It states that Canva does not use business, team or enterprise content to improve AI-powered features and does not allow third parties to do so, that the privacy-settings control is disabled on Business and Enterprise accounts, and that Education users can neither opt in nor opt out. Also the source for current certifications.
- Canva Magic Studio product documentation
- Canva Shield: Safe Fair and Secure AI (canva.com/newsroom/news/safe-ai-canva-shield, updated January 2026)
- Canva Shield indemnification overview (canva.com/safe-ai-canva-shield)
- Canva AI Product Terms (November 28, 2025 version)
- Canva Help Center: How to use Magic Studio safely and legally
- Terms.Law: Canva AI Output Rights & Commercial Use Guide 2026 (March 2026)
- TechCrunch: Canva acquires startups working on animation and marketing (February 23, 2026)
- Bloomberg coverage of November 2025 Figma class action filing
- 2019 Canva data breach disclosures and follow-up coverage
Related on AI Leakage
- Compare all 29 AI tools in the risk directory — see how Canva Magic Studio stacks up against the rest, tier by tier.
- Take the 5-minute “Am I Leaking?” check — a personalised view of your business’s AI exposure.
- Check a prompt before you paste it — our free Data-Safe Prompt Rewriter.
- Shadow AI vs AI leakage — why even approved tools like Canva Magic Studio can leak data.
- Get plain-English AI Leakage Alerts — we email you when an AI tool you use changes its data policy or has an incident.
- Get the free AI Acceptable Use Policy template — a plain-English policy with the tool-by-tool risk guide built in.
Compare similar tools: Canva Magic Studio is one of 6 tools in AI writing, design and voice tools compared, which sets out each one’s rating and what it does with your data, side by side.