Duolingo, Inc. (NASDAQ: DUOL) is a publicly traded, ad-supported freemium language-learning app. Its own App Store privacy label self-declares collection of Purchases, Location, Contact Info, User Content, Identifiers, Usage Data, Diagnostics, and Other Data, and separately flags several of those categories (Purchases, Location, Contact Info, User Content) as 'Data Used to Track You' across apps and websites owned by other companies. Duolingo's SEC filings disclose an advertising-revenue business model built on serving free-tier users to advertising partners, and separately disclose that Duolingo operates products aimed at children (Duolingo ABC) that fall under COPPA. In 2023, an exposed public API let a third party scrape a dataset covering 2.6 million user records, including non-public email addresses; Duolingo characterized this as a scrape of public profile data rather than a breach or hack, and the underlying API reportedly remained accessible for months after being reported. Corporate ownership is highly traceable via SEC filings, including a disclosed dual-class share structure concentrating voting control with named co-founders.
TRACK RECORD
1 BREACH
[2023-01-24] · BREACH
Have I Been Pwned lists a breach record for Duolingo: "Duolingo".
Approximately 2,676,696 accounts affected, per HIBP.
Duolingo's official App Store listing self-declares, under Apple's app privacy label, that data collected and linked to a user's identity includes Purchases, Location, Contact Info, User Content, Identifiers, Usage Data, Diagnostics, and Other Data.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
Duolingo's FY2025 Form 10-K states that the Children's Online Privacy Protection Act (COPPA) applies to operators of commercial websites and online services directed to children, and separately discloses that Duolingo ABC is an app the company operates that teaches young children early literacy skills, placing part of Duolingo's product line under child-directed data-collection regulation.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — No.
Duolingo's FY2025 10-K discloses a dual-class stock structure in which Class B common stock carries a 20-to-one voting ratio over Class A, letting Class B holders (including named co-founders Luis von Ahn and Severin Hacker) collectively control a significant percentage of the combined voting power of the company's common stock.
Duolingo's App Store privacy label's 'Data Used to Track You' disclosure is itself evidence of data sharing for cross-company ad tracking: the same Purchases, Location, Contact Info, and User Content categories flagged for collection are also flagged as usable to track the user across apps and websites owned by other companies.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
Duolingo's FY2025 10-K states that its advertising revenue depends on serving its free users to advertising partners and on maintaining relationships with those partners, describing an ad-supported free-tier business model.
As of 2026-08-17, Duolingo's own ads.txt file at www.duolingo.com authorizes 1 advertising system domain(s) to sell its ad inventory (1 DIRECT and 0 RESELLER entries).
Have I Been Pwned's breach catalog lists the "Duolingo" incident (duolingo.com), breach date 2023-01-24, affecting approximately 2,676,696 accounts. Data classes exposed per HIBP: Email addresses, Names, Spoken languages, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
In August 2023, BleepingComputer reported that a dataset covering 2.6 million Duolingo users, including non-public email addresses, was scraped via an exposed public API and released on a hacking forum; Duolingo confirmed to a reporter that the data came from public profile scraping rather than a breach, and BleepingComputer found the same API still openly accessible months after its abuse was reported to the company.
Duolingo's App Store privacy label includes a distinct 'Data Used to Track You' section, self-declaring that Purchases, Location, Contact Info, and User Content data may be used to track the user across apps and websites owned by other companies.