Quizlet

GDPR overview

Implementation is concrete and documented, but incomplete. Quizlet, Inc. names itself controller under the GDPR for individuals in the EEA, the United Kingdom and Switzerland, and has certified to the US Department of Commerce under the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework. International transfers rely on those frameworks or on Standard Contractual Clauses approved by the European Commission. Rights of access, rectification, erasure, portability and objection are each set out, with a dedicated channel at privacy-eu@quizlet.com and unresolved complaints referred free of charge to JAMS, the Federal Trade Commission acting as enforcement authority. Two gaps stand out: no Article 27 representative and no data protection officer is named anywhere in the policies, and no data processing agreement is offered, including on the schools page.

Who owns the data?

Quizlet, Inc. acts as the data controller under the GDPR for individuals in the EEA, the United Kingdom and Switzerland. Users create the study material themselves, from flashcard sets to uploaded notes, and decide whether it stays private or is visible to other members. They may review, edit or delete that content at any time with the tools provided, and can close the account entirely from Settings, at which point the content they created is deleted in line with Quizlet's retention policies. Rights of access, rectification, erasure, portability and objection are documented for European users and exercised through a dedicated address, privacy-eu@quizlet.com.

Reuse rights

The terms give end users no free rein over other people's material. Sets published by teachers, students and experts can be studied and copied into a learner's own workspace through the product's own features, but the Honor Code limits what that material may be used for: it exists to support learning, not to supply answers for work that will be handed in, and an institution's own rules take precedence. Quizlet, for its part, uses account and usage data to run the service, to market it, to serve targeted advertising, to measure audiences, to prevent fraud and to meet legal obligations, and shares it with named service providers. Nothing in the published pages states whether user content feeds AI model training, and no opt-out is documented either way.

Data retention & training

Hosting summary

Data is hosted and processed in the United States, under US jurisdiction. Quizlet publishes a named list of third-party providers, which identifies Google Cloud Platform as the host of the site's content and traffic data, with encryption of data written to disk, Amazon Web Services for compressed database archives and image serving, and Cloudflare for network infrastructure. Google, Facebook and Apple appear as federated login providers. The privacy policy states plainly that, because the company operates in the United States, personal information may be transferred there from the EEA, the United Kingdom and Switzerland, and warns that the destination may not offer equivalent protection and that data held in the US can be subject to lawful requests from courts or law enforcement. Those transfers are covered by the EU-US, UK Extension and Swiss-US Data Privacy Frameworks or by Standard Contractual Clauses. No hosting country other than the United States is named, and no hosting region is identified as such. The provider list itself carries a last-modified date of August 2019, so its contents may no longer be current.