Khan Academy

Is Khan Academy safe?

Yes. Khan Academy is free, run by a nonprofit, shows no third-party ads, and handles children's accounts with tighter rules than most learning apps. We score it 77/100, ahead of Kahoot! (74) and Duolingo (61), and a little behind its own preschool app, Khan Academy Kids (80), which has no forums and no AI chatbot.

The two things parents should understand are Khanmigo, the AI tutor, and the website's marketing cookies. Khanmigo is closely supervised but keeps chats for a year or more. The cookies are why Common Sense's privacy programme rated Khan Academy only 78%, with a "Warning".

What data Khan Academy collects

Apple's privacy label for the main Khan Academy app is short. The only data linked to you is how you use the app, for analytics and personalisation. Name, email address, user ID, search history and crash data are listed as not linked to you, and nothing is used to track you. Google Play says the app shares no data with other companies.

The privacy policy, last updated on 30 January 2026, says Khan Academy does not sell personal information and does not show third-party ads. Companies can sponsor whole topics, such as astronomy, but sponsored content is labelled and sponsors cannot track users.

The weak spot is on the website. Khan Academy uses cookies "to market our service", and the policy says it avoids tracking only on pages with child-directed content and when it believes students or children are using the service. Common Sense's November 2024 evaluation found that user information is used to target ads on other websites, and gave the service its "Warning" rating for that reason. Adults who want to avoid it can turn off non-essential cookies in the cookie settings.

Khanmigo: what the AI tutor does with chats

Khanmigo runs on OpenAI technology. Families pay for it, with a billing address in the US, while teachers get a free version. A learner must be 18, or a parent must sign them up; children at school get it through their district.

Supervision is the strong point:

• Moderation checks both text and images. When a chat is flagged, the parent, or the teacher for school accounts, gets an email and an in-app alert. Districts can also send alerts about "credible harm" to their administrators.
• Parents and teachers can read every Khanmigo conversation, and Khan Academy tells students so in its guidelines.
• Khan Academy's contracts bar its AI providers from training their models on what users type.

Retention is the cost. Chats stay viewable for up to 365 days after the conversation ends, flagged chats can be kept for two years, and chats used in research can be held for two years after a study ends. Khan Academy also uses de-identified chats to improve its products. Its school notice tells users not to type personal information into the AI features at all.

Children's accounts and forums

Accounts for under-13s need a parent's consent, or the school's for class use, and they are restricted. A child account cannot add personal details to its profile, cannot post questions or answers in the forums, and cannot share computer programs publicly. Khan Academy sends its emails to the parent or teacher instead. A child account is deleted after seven days if no parent confirms it.

Teenagers 13 and over can use the discussion forums, which follow community guidelines. Apple rates the app 13+, citing infrequent mature or suggestive themes, medical information, references to drugs, alcohol and tobacco, sexual content or nudity, and weapons. These come from biology, health and history lessons, not from other users.

Security

Khan Academy says it has a SOC 2 Type 2 security audit every year, hosts the site and app on Google Cloud in the US with an extra layer of encryption on personal data, and supports TLS 1.3 for traffic. Since August 2026, accounts that sign in with an email and password can turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary with an authenticator app and recovery codes; accounts that sign in through Google or Facebook rely on that provider's login. It runs a vulnerability disclosure programme on HackerOne that pays no bounty. We found no reported breach.

The security page still calls Khan Academy a signatory of the Student Privacy Pledge. The Future of Privacy Forum retired the pledge on 25 April 2025, though signatories remain bound by its commitments for data collected while it ran.

How to set up Khan Academy safely

1. Create your child's account from your own parent account, so you hold the controls and get Khanmigo alerts, and turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary under Security in your settings.
2. Read your child's Khanmigo chat history now and then, and remind them not to type full names, addresses or school details.
3. Ask for early deletion of Khanmigo chats if you do not want them kept for a year.
4. Turn off non-essential cookies on the website if you do not want Khan Academy's marketing to follow you.

How we scored it

Scams and harmful content (82) is Khan Academy's strongest factor after its clean regulatory record (87): the content comes from Khan Academy itself, child accounts cannot post, and Khanmigo is supervised. Privacy (72) is the weakest, because the website's marketing cookies earned a Common Sense warning and Khanmigo chats are kept for a long time. Security (76) rests on an annual SOC 2 audit and optional two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login, held back by the lack of a paid bug bounty.