Chegg is a publicly traded (NYSE: CHGG) U.S. education-technology company offering homework help, tutoring, textbook rental, and adjacent services (including the Busuu and EasyBib brands) to students. Chegg's own privacy policy discloses that education records (school, courses, grades/graduation status) are used not only to deliver the service but also for "advertising and marketing activities," that submitted user content may be used to train or fine-tune Chegg's and third-party providers' AI/ML models, and that automatic-collection technologies on its site include session-replay-style recording of mouse movements, scrolling, clicks, and keystrokes alongside conventional cookies, pixels, and mobile SDKs. Chegg's CCPA disclosures self-declare that it "sell[s]/share[s]" personal data for targeted and cross-contextual behavioral advertising via cookies, working with ad networks, identity-resolution providers, data brokers, and data-management platforms. The FTC finalized an order against Chegg in January 2023 after four data breaches (2017–2020) exposed roughly 40 million users' and employees' Social Security numbers, passwords stored with outdated encryption, and sensitive scholarship/health data, and in September 2025 the FTC separately obtained a $7.5 million settlement over deceptive subscription-cancellation practices.
TRACK RECORD
1 BREACH · 2 ENFORCEMENT ACTIONS
BREACH LEDGER
[2018-04-28] · BREACH
Have I Been Pwned lists a breach record for Chegg: "Chegg".
Approximately 39,721,127 accounts affected, per HIBP.
The FTC's September 2025 press release states Chegg agreed to pay $7.5 million to settle allegations of deceptive subscription-cancellation practices, after charging nearly 200,000 consumers since October 2020 following their cancellation requests, in violation of ROSCA.
The FTC's January 2023 press release states it finalized an order against Chegg for careless data security practices, following four data breaches that exposed the personal information of about 40 million users and employees, including Social Security numbers, weakly encrypted passwords, and sensitive scholarship, health, and financial data.
Chegg's privacy policy states that Education Information — school name, degree, year of graduation, courses, and Skills Service performance/graduation status — is used not only to provide services but also for advertising and marketing activities and personalization.
Chegg's Apple App Store privacy label discloses that data linked to the user's identity spans Purchases, Location, Contact Info, User Content, Search History, Identifiers, Usage Data, Diagnostics, and Other Data — a broad set collected across App Functionality, Product Personalization, Analytics, and Other Purposes, including for third-party AI/ML training as separately disclosed in the privacy policy (see claim 1).
Chegg Inc.'s Form 10-K for fiscal year 2025, filed with the SEC, confirms its Common Stock, $0.001 par value per share, trades on the New York Stock Exchange under ticker symbol CHGG, and identifies Chegg, Inc. and its subsidiaries (including the Chegg Study, EasyBib, and Busuu brands) as the reporting company.
Chegg's privacy policy states it works with a wide ad-partner ecosystem — including demand-side/sell-side platforms, ad servers, clean room providers, identity resolution providers, data brokers, and data management platforms — and its CCPA disclosures separately self-declare that it "sell[s]/share[s]" personal data for targeted or cross-contextual behavioral advertising via cookies, with opt-out via a footer link or Global Privacy Control signal.
Have I Been Pwned's breach catalog lists the "Chegg" incident (chegg.com), breach date 2018-04-28, affecting approximately 39,721,127 accounts. Data classes exposed per HIBP: Email addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
The FTC's January 2023 press release states it finalized an order against Chegg for careless data security practices, following four data breaches that exposed the personal information of about 40 million users and employees, including Social Security numbers, weakly encrypted passwords, and sensitive scholarship, health, and financial data.
The FTC's September 2025 press release states Chegg agreed to pay $7.5 million to settle allegations of deceptive subscription-cancellation practices, after charging nearly 200,000 consumers since October 2020 following their cancellation requests, in violation of ROSCA.
Chegg's Apple App Store privacy label states that data may be used to track the user across apps and websites owned by other companies — Apple's ATT-framework disclosure for cross-app/cross-site tracking.
Chegg's privacy policy states that beyond cookies, web beacons, pixels, embedded scripts, and mobile SDKs, its automatic-collection technologies also record how users interact with its services, including recordings of mouse movements, scrolling, clicks, and keystroke activity.