Canvas LMS

Overview

Canvas LMS is a learning management system developed by Instructure, Inc., widely adopted by universities, K-12 school districts, community colleges, and corporate training programs. Canvas holds a dominant market position in higher education in the US and has significant global adoption. When integrated into institutional websites or portals, Canvas embeds course content players, assignment submission interfaces, quiz engines, and learning module navigators that allow students and learners to interact with course material within the host environment.

What This Script Does

Canvas LMS embeds load JavaScript from the institution's Canvas instance — typically hosted at *.instructure.com (Instructure's cloud) or a custom subdomain (e.g., canvas.university.edu) — to render course content and interactive learning components. The Canvas JavaScript SDK and course player scripts handle content playback, quiz delivery, assignment submission, discussion forum rendering, and grade display.

Cookies Set by Canvas LMS Embeds:

• canvas_session — encrypted session authentication cookie, session-scoped (or persists for the duration of the login session, typically 24 hours); set under the institution's Canvas domain; maintains the learner's authenticated session with the LMS
• _legacy_normandy_session — legacy session cookie maintained for backward compatibility with older Canvas features, session-scoped
• csrf_token — CSRF protection token, session-scoped; required by Canvas's Rails backend for all POST/PATCH/DELETE requests
• remember_user_token — persistent remember-me cookie, 30 days; set if the learner selects "Remember me" at login; enables re-authentication without password entry
• timezone — stores the user's detected timezone as a preference cookie, persistent; used to display assignment due dates and calendar events in the correct local time

Engagement Tracking and Analytics:

• Canvas records detailed engagement events in its Analytics infrastructure: time spent on each content item (page, video, assignment), quiz attempt data (answers submitted, time per question, score), assignment submission timestamps, discussion post frequency, and login patterns
• These events populate Canvas Analytics and New Analytics dashboards visible to instructors and administrators
• Event data is transmitted to Instructure's analytics pipeline (analytics.instructure.com) for processing
• Canvas Data — Instructure's bulk data export service — can deliver raw event logs to institutional data warehouses for institutional research

LTI Tool Integrations:

• Canvas embeds often include Learning Tools Interoperability (LTI) launches that load third-party tools (e.g., Turnitin, Kaltura, Respondus) within iframes; each LTI tool may set its own cookies and perform its own data collection

Instructure, Inc. is a US company. Canvas cloud is hosted in AWS (US-EAST, EU-WEST). GDPR-compliant DPA available. For EU institutions, Instructure offers EU data residency with processing confined to AWS EU regions. Instructure participates in the EU-US Data Privacy Framework.

Consent & Compliance

Canvas LMS embeds are categorized as functional technology. Under GDPR and the ePrivacy Directive, cookies that maintain an authenticated learning session and track course progress are strictly necessary for the educational service the learner has enrolled in. Data processing is based on the contractual relationship between the institution and the student under GDPR Article 6(1)(b), or on the institution's legitimate interest in delivering educational services under Article 6(1)(f). Under CCPA/CPRA, student learning data processed by Canvas in an educational institution context is subject to FERPA (20 U.S.C. §1232g), and FERPA-protected educational records are explicitly exempt from CCPA under Cal. Civ. Code §1798.145(e)(3).

Should You Block This Without Consent?

No. Canvas LMS embeds are functional educational tools whose cookies and engagement tracking serve the core learning experience — authenticated session management, progress tracking, and grade recording. Blocking would prevent students from accessing course content and completing assignments.