Kahoot!

Is Kahoot safe?

Yes. Kahoot! is one of the lower-risk apps a child will meet at school: there is no chat, no third-party advertising, and a pupil can play a teacher's quiz with nothing more than a PIN and a nickname. We score it 74/100, a point ahead of ClassDojo (73) and well ahead of Quizlet (62), which tracks free users for ads.

The risk is in how games are opened, not in the data. A Kahoot! game PIN works for anyone who has it, so PINs posted online draw strangers and bots with rude nicknames. Teachers who lock the lobby avoid nearly all of this.

What Kahoot collects

How much Kahoot! knows depends on who is playing.

• Pupils joining a game with a PIN enter only a nickname and their answers. In a school setting, Kahoot!'s privacy notice says it acts as a processor for the school, does not sell student data, does not build student profiles outside school purposes, and does not use student data for targeted ads anywhere.
• Children with their own account (under 13 in the US, under 16 elsewhere) give an email address, which Kahoot! hashes at once so it works only as a password reminder, plus a username and password. Usage data is still collected automatically, and Kahoot! says it sends no marketing to child accounts.
• Adult account holders, mostly teachers and parents, are where data adds up. Apple's privacy label lists no tracking, but links gameplay, user ID, purchase history and search and browsing history to the account for analytics, and lists name, email and gameplay under "Developer's Advertising or Marketing".

Google Play's data safety section says Kahoot! shares no data with other companies. The privacy notice, effective 22 October 2026, also says Kahoot! does not use platform data to train large language models and does not let its AI suppliers do so. Common Sense's privacy programme gives Kahoot! 92% and its Privacy Verified Seal, a review that covers Kahoot! Kids, the DragonBox maths apps and Poio as well.

Who owns Kahoot?

Kahoot! started in 2012 out of research at the Norwegian University of Science and Technology. It listed on the main Oslo Stock Exchange in March 2021 and was delisted in 2024, after its acquisition by Goldman Sachs Asset Management, General Atlantic, KIRKBI and the Kahoot! team, which the company names as its current owners.

The change of owner did not change the privacy rules on paper. The main data controller is still Kahoot! AS in Norway, so GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary applies, and US schools are covered by FERPA, COPPA and California's SOPIPA, which the notice names. The Kahoot! group also includes Clever, the K-12 sign-in service, which has its own policies.

Game PINs, bots and nicknames

Kahoot! has no chat and says children cannot contact strangers through the app. Its safety guide lists the protections that matter in a live game:

• A profanity filter checks nicknames and typed answers.
• A nickname generator gives players random names, so no one can type an offensive one.
• The host can lock the game once everyone has joined, which keeps out late arrivals and bots.
• The host can remove any player by clicking their nickname, and find the player's identifier later in the session report.

Public quizzes made by users are the other open door. Kahoot! says software flags or quarantines public content and a trained moderation team reviews it. A teacher using someone else's public quiz should still check it before showing it to a class.

Security

Kahoot!'s Trust Center says the company holds an ISO 27001 certificate, encrypts customer data at rest with AES-256 and in transit with TLS 1.2 or higher, and has a named chief information security officer. Its suppliers hold ISO 27001 and SOC 2 Type 2 certificates. Personal accounts can turn on multi-factor login with an authenticator app and backup codes, a help article updated in September 2026 says. We found no reported breach of Kahoot!. Researchers can report flaws to [email protected] under a disclosure policy that pays no reward. Schools get single sign-on, roster sync and data deletion controls.

How to run a Kahoot game safely

1. Turn on multi-factor login in your host account's profile settings.
2. Turn on the nickname generator before a class game, so pupils cannot type their own names.
3. Lock the game once the whole class has joined, and do not post live PINs on social media.
4. Check any public quiz from another creator before showing it to children.
5. Watch the renewal date on any paid plan; the App Store lists ten Kahoot! in-app purchases, from $5.99 to $143.99.

How we scored it

Scams and harmful content (80) is Kahoot!'s strongest factor after its clean regulatory record (87): there is no chat, and hosts have real tools against bots and rude names. Privacy (68) is the weakest, because adult accounts feed Kahoot!'s own marketing and Apple's label links browsing and search history to them. Security (75) gains from an ISO 27001 certificate and multi-factor login but loses points for having no paid bug bounty, and transparency and control (72) for automatic renewals across many paid plans.