Duolingo

Is Duolingo safe?

Yes. Duolingo is a low-risk app for adults and children: there are no private messages, almost no user-generated content and no record of privacy fines. We score it 61/100, a little below Slack (65) and well ahead of YouTube (54).

What keeps the score from going higher is advertising. The free app shows an ad after each lesson, and ad networks track you to choose them. Apple's privacy label for Duolingo lists eight types of data used to track you across other companies' apps and websites, against two on YouTube's label. Advertising was about 7.7% of Duolingo's revenue in 2025, according to its annual report, so the tracking pays for a small part of the business. It still applies by default to adult free users in the US, and only about 9% of its 130 million monthly users pay.

What Duolingo tracks

The App Store label is unusually long for a learning app. Used to track you: purchases, coarse location, contact info, user content, identifiers, usage data, diagnostics and "other data". Linked to your identity, it adds financial info, contacts and search history.

The privacy policy, revised in May 2026, names the ad networks: Unity, Meta, LiftOff, Pangle, Moloco and Google. Two other details matter:

• Session recording. FullStory and Session Replay log clicks, scrolling and typing to show Duolingo how people use the app. The policy says they do not record passwords or email addresses, and a "Tracking" switch in Settings turns them off.
• AI features. Text and audio from Video Call and other AI features may be sent to OpenAI and Google. Duolingo says its contracts stop them using the data for their own purposes.

Where you live changes the defaults. Users in the EU and UK are opted out of personalised ads unless they opt in, and everyone under 16 gets non-personalised ads with third-party tracking and analytics switched off. US adults are opted in. Duolingo's annual report says it does not sell personal data.

The 2023 scraping leak

In January 2023 a dataset of Duolingo users was offered for sale on a hacking forum for $1,500. In August it was released for almost nothing. Have I Been Pwned counts 2,676,696 records with email addresses, names, usernames and the languages being learned.

The data was not stolen from Duolingo's servers. A Duolingo API accepted an email address and returned the matching profile. Someone fed it millions of addresses from older breaches and kept the hits. Duolingo told reporters the data was "scraped from public profile information". BleepingComputer pointed out that the email addresses were not public, and that the API was still open months after the abuse was reported.

The practical risk is phishing: an email that knows your name, username and the language you study looks convincing. No two-step login option for Duolingo accounts was found, so a strong, unique password matters more than usual.

Is Duolingo safe for children?

This is Duolingo's strongest area. Under the privacy policy, users under 13 in the US, or below the age of digital consent in their country, register with a username only. Duolingo does not collect their name, email or phone number, and asks for a parent's email the first time they log out. Child users:

• see only non-personalised, family-safe ads, with third-party tracking off;
• cannot add a real name or photo, only a letter or cartoon avatar;
• can send and receive only preset comments, and only to friends;
• appear under a random fake name on leaderboards, and are never suggested to adult users.

Duolingo ABC, the reading app for young children, keeps speech data on the phone and uses Apple's speech recognition. The main risk left for children is the same as for any game-like app: streaks, notifications and leaderboards are designed to keep them coming back.

How to use Duolingo more privately

1. Set your profile to private in Settings. A public profile is visible to anyone on the internet and to scrapers.
2. Turn off personalised advertising in the app Settings, and switch off the "Tracking" toggle to stop session recording.
3. Do not sync your contacts unless you want friends to find you; disabling it later deletes the uploaded contacts.
4. Use a unique password, and be wary of emails that mention your Duolingo username or course.
5. To leave, use the Data Vault to download and erase your data, and cancel any subscription in the App Store or Google Play first.

How we scored it

Regulatory record (92) and content safety (88) are Duolingo's strongest factors: no fines found, no private messages and careful limits for children. Privacy (40) is the weakest, because the free app tracks users for third-party ads by default in the US. Security (55) reflects the 2023 scraping leak through an API that stayed open after it was reported, and the lack of a two-step login option.