Skip to main content

Privacy policy

Common Application Privacy Policy

Last updated: October 2, 2026

1. Notice

This Privacy Policy applies to properties owned and operated by The Common Application, Inc.® (“Common App”, “We”, “Us”, “Our”), which include www.commonapp.org, apply.commonapp.org, and recommend.commonapp.org, (“Web Site”) and our mobile app (the “App”) (collectively, “Properties”). This Privacy Policy (“Policy”) describes how Common App collects and uses the Personal Data you provide through our Properties. It also describes the choices available to you regarding our use of Personal Data about you and how you can access and update this information. “Personal Data” refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with you, directly or indirectly.

Please read this Policy carefully before providing us with any information. If you are a citizen of the U.S. or EU/UK, please also review the Supplemental Statements on your U.S. and EU/UK data privacy rights (located at the end of this Policy). When you visit or use our Properties, interact with customer service representatives, work with us, apply to work with us, or otherwise engage or interact with Common App or its employees, contractors, agents, or representatives, you understand that we will collect, use, and disclose your Personal Data as described in this Policy.

Please note that Common App is a not-for-profit organization based in the U.S. Any Personal Data you provide or we collect is transmitted to, and stored in, the U.S. and will also be shared with our Partners and Member Institutions, at your direction, including in countries where laws may be less protective of Personal Data about you than in your home country.

2. This policy will inform you about:

  • Changes to this Policy
  • Personal Data Common App collects and how we use it
  • With whom Common App shares the information we collect about you
  • Your choices regarding communications from Common App and Member Institutions
  • Common App’s Data Retention Policy
  • Common App’s Data Security Policies and Practices
  • Children’s Privacy
  • How you can contact us regarding this policy
  • Supplemental privacy provisions (U.S. and EEA/UK)

3. Changes to this Policy

Changes to this Policy will be posted on this page. We reserve the right to modify this Policy at any time, so please review it periodically to learn of updates. If you do not accept this Policy, please do not use our Properties.

4. Personal Information Common App Collects and How We Use Information

A. Properties Visitors

  • Categories of personal information:
    • When you contact us through a contact form on our Properties or by email: we collect your name, email address, and any other information that you decide to share with us.
    • With your permission, where it is required by applicable laws, we and/or our Partners (defined below) may automatically log information about you, your browser, your computer or mobile device, and your activity on the Properties. The information that may be collected automatically includes your computer or mobile device operating system type and version number, manufacturer and model, device identifier (such as the Google Advertising ID or Apple ID for Advertising), browser type, screen resolution, IP address, the website you visited before browsing to our Properties, general location information such as city, state or geographic area; and information about your use of and actions on the Properties, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and length of access. We and/or our Partners may collect this type of information over time and across third-party websites and mobile applications. This information is collected using cookies and similar tracking technologies. Please consult our Cookie Notice for more information.
    • The Properties include social media features, such as links to our Facebook, X (formerly Twitter), LinkedIn, YouTube, TikTok, and Instagram pages. When you visit or interact with our pages on social media platforms you are agreeing to the platform provider’s privacy policy. This may include sharing with us your name, profile, photos, reactions and comments to our posts, etc. The platform provider’s privacy policy applies to your interactions and their collection, use and processing of your Personal Data. You or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.
  • Purposes for processing:
    We use this information:
    • To provide, operate, and improve our Properties
    • To respond to your requests, questions, and feedback
    • To analyze and improve our Properties
    • To provide you with a personalized experience and advertisements
    • For compliance, fraud prevention, and safety.

B. Applicants

Applicants are those who have created an account with Common App.

  • Categories of personal information:
    • When you create an account, we collect your name, email address, home and mailing address, phone number, date of birth, and information regarding your plans to attend college. If you are a transfer student, we also collect information regarding your citizenship/nationality.
    • When you create a profile, we may collect your name, home and mailing addresses, home and telephone numbers, gender, legal sex, pronouns, military status, race, language proficiency, place of birth, duration of residency in the U.S./other country of residency, citizenship status, and financial status.
    • When completing an application(s), Common App collects detailed information regarding your education, testing, extracurricular and/or community involvement history, and college goals/plans. We also collect any and all information you voluntarily provide in your application(s), including writing samples and essays.
    • Common App may also collect Personal Data about you from recommenders and educational institutions you have attended, including information about your academic achievements and performance, recommendations and impressions of you, and any other information these parties choose to provide us in connection with your application(s).
  • Purposes for processing:
    We use this information:
    • To process your application(s) to our Member Institutions that require the information to assess your suitability for admission, communicate with you about your application, and meet institutional reporting requirements regarding certain protected characteristics (including gender, race, ethnicity, and sexual orientation) and obligations to safeguard students. If you do not provide the information our members require, we will be unable to process your application.
    • To allow you to pay fees required for your application to our Member Institutions by linking you to the Illumia (formerly Transact) website, which collects your payment-related information.
    • To validate the mailing address that you provide to further our legitimate interests in obtaining accurate information and preventing misuse of the Common App and our Properties.
    • To prevent and detect fraud and abuse in order to protect the security and integrity of our users, Members, Common App, and others.
    • To generate aggregate data for research and product development purposes.
    • To inform marketing and advertising campaigns to promote Common App programs and services.
    • To collaborate with third-party researchers on specific research projects, as governed by time-limited data use agreements.
    • To provide Member Institutions and Partners with aggregated data to inform their planning.
    • To allow you to participate in Common App Programs, which includes the Direct Admissions Program.
    • To allow you to opt-into and participate in Partner Programs, which requires sharing your information with those Partners.
    • To communicate with you. Applicants may opt-out of programs or request their data be deleted by submitting a request to Common App.
    • To participate in the Scholarship Matching Program, for which no personal information will be shared.

C. Parents/Guardians and Siblings of Applicants

  • Categories of personal information:
    If you are a parent or legal guardian of an Applicant, we may collect Personal Data about you from the Applicant: name, marital status, household member information, children, whether the parent is living or dead, occupation, and education level. Common App also collects the number of siblings an Applicant has.
  • Purposes for processing:
    • To allow us to communicate with parents or legal guardians of minors so we and our Member Institutions can get evidence of parent or guardian permission to collect the minor Applicant’s Personal Data.
    • To generate aggregate data for research and product development purposes.
    • To collaborate with third-party researchers on specific research projects, as governed by time-limited data use agreements.
    • For Member Institutions to use for institutional reporting and to contextualize application information.

D. College/University Administrators

  • Categories of personal information:
    If you are an administrator at one of our Member Institutions who uses Common App to receive student admission application data, we collect your name and email address to permit you to retrieve data of Applicants who have applied to your college or university using the Common App. The Personal Data of the administrator is also shared with certain third-party vendors to enable member administrators to gain access to Applicant’s payment status information.
  • Purposes for processing:
    We use this information to perform the contractual relationship that we have with the Member Institution you work for.

E. School Officials

  • Categories of personal information:
    If you are an official or employee at an educational institution, when you register for an account with our Properties, we collect information about you and your position at your school, including your name, your position and/or title, and your contact information, including email address, phone number(s), and mailing address(es) and zip code.
  • Purposes for processing:
    We use this information to perform the contractual relationship that we have with the educational institution you work for.

F. Recommenders

  • Categories of personal information:
    If you wish to submit recommendations for or on behalf of an Applicant’s applications to one or more Member Institutions, you must register an account with our Properties and provide information about yourself, including information about you and your relationship with the Applicant, including your name, your position and/or title, any school code information, and your contact information including email address, phone numbers, and mailing address(es) and zip code.
  • Purposes for processing:
    To process Applicant’s submission(s) to our Member Institutions.

G. Job Applicants

  • Categories of personal information:
    Job applicants apply for open positions with Common App through Workable. We collect your resume and EEO information, if it is disclosed. For more information, please review Workable’s privacy policy.
  • Purposes for processing:
    To review job applicant’s qualifications for the position applied.

Common App also collects the above information when we believe that disclosure is necessary to protect our rights and the rights of our Member Institutions and/or to comply with law or legal obligation (including to meet national security or law enforcement requirements).

5. With Whom Common App Shares the Information We Collect About You

Common App does not sell your Personal Data.

Common App may disclose your Personal Data to third parties where it is necessary and for purposes described in this Privacy Statement or as notified at the time of collection, including:

  • Service Providers: Common App shares Applicant’s names, phone numbers, and home addresses with service providers to confirm the accuracy of the mailing address you enter. Applicant payment card information is shared with a payment card processor in order to make payment of admission application fees to the selected Member Institutions. We may also share your Personal Data with carefully vetted Service Providers who assist us in fraud prevention, product research, development, and the testing of new technologies. These vendors are strictly bound by confidentiality and data processing agreements that prohibit them from using your data for their own independent commercial purposes or model training. We may also share Data about you with other third-party organizations, allowing us and/or them to generate aggregate data which we and/or the third party may publish, combine, or enhance with other aggregate data obtained from other sources, and/or share or distribute the aggregate data. We also use services to provide and maintain our Properties.
  • Member Institution(s): Common App shares Personal Data about Applicants who have created an account on Common App with colleges and/or universities that are members of Common App (“Member Institutions”) when the Applicant applies to a Member Institution or when the Applicant adds a Member Institution to their college. This allows Member Institutions to assess Applicants’ suitability for admission, communicate with Applicants, and meet institutional reporting requirements about Applicants. Note that even if an Applicant never applies through the Common App, the Member Institutions in which the Applicant has indicated interest via the Applicant’s college list will still have access to the Applicant’s Personal Data as part of the Applicant’s pre-application data prior to the application being submitted. Such Member Institutions may use this information, for example, to contact Applicants even prior to the time an application is submitted to provide information about their institutions and admission processes and deadlines or track the demographics of their prospective applicant pool. Common App also shares information with Member Institutions for their Direct Admissions Program and their own direct marketing purposes if an Applicant adds that Member Institution to their college list.Common App shares Personal Data about Applicants who have created an account on Common App with colleges and/or universities that are members of Common App (“Member Institutions”) when the Applicant applies to a Member Institution or when the Applicant adds a Member Institution to their college. This allows Member Institutions to assess Applicants’ suitability for admission, communicate with Applicants, and meet institutional reporting requirements about Applicants. Note that even if an Applicant never applies through the Common App, the Member Institutions in which the Applicant has indicated interest via the Applicant’s college list will still have access to the Applicant’s Personal Data as part of the Applicant’s pre-application data prior to the application being submitted. Such Member Institutions may use this information, for example, to contact Applicants even prior to the time an application is submitted to provide information about their institutions and admission processes and deadlines or track the demographics of their prospective applicant pool. Common App also shares information with Member Institutions for their Direct Admissions Program and their own direct marketing purposes if an Applicant adds that Member Institution to their college list.
  • Partner Programs: Common App offers certain Partner Programs, which include Scholarship Programs, where we work with other organizations to provide additional opportunities related to an Applicant’s college journey, with which we may share Applicant Personal Data. Applicants are given the opportunity to choose whether they want us to share Personal Data for the purpose of participating in certain Partner Programs. If Applicants choose to opt-out of a Partner Program, they must opt out both with Common App and the Partner. Common App also shares information with Partner Programs for their own direct marketing purposes.

    Common App has relationships with a number of partner programs. The Common App does not establish criteria or select recipients for these partner programs. All applications, eligibility requirements, and awards are determined solely by the individual programs. Program participation, including for scholarship selections, is subject to the specific terms, conditions, and selection processes of the sponsoring organization, independent of the Common App.

  • Business Partners (“Partners”): We may sometimes share your Personal Data with Partners or enable them to collect information directly via our Properties. Our Partners include, notably, Google, Facebook, Instagram, LinkedIn, X (formerly Twitter), TikTok, and YouTube. Please read our Partners’ privacy policies to understand how they use your Personal Data.
  • Professional Advisors: We may disclose your Personal Data to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.
  • Authorities and others for compliance, fraud prevention and safety: We may share your Personal Data for the compliance, fraud prevention, and safety purposes described above.
  • Business transferees: Common App does not sell your personal data. However, we may sell, transfer, or otherwise share some or all of our business or assets, including your Personal Data, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.
  • Mobile messaging: Sharing excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

6. Your Choices Regarding Communications

Applicants. When you create an account on Common App, you are required to express your communications preferences to receive communications from Common App. These communications may be emails, phone calls, text messages, physical mailings, or other types of communications with information that Common App feels would benefit you, including, but not limited to, financial aid information, application tips, and content about Common App’s programs and services to help you on your higher-education journey. If you later decide that you would like to opt out of these communications, please submit your request via the opt-out instructions provided in the communication. You can also opt-out of these communications by contacting the Solutions Center via the “Need Help” link on your applicant account page or by selecting it in the Communications Preferences in Settings on your applicant account page. If you opt out of communications with Common App, we may still contact you regarding your account with us, including, but not limited to, communications about registration, submissions, and technical support questions we receive from you.

School Officials and Recommenders. We may communicate with you by email, phone calls, text messages, physical mailings, or other types of communications that contain Applicant information, Member Institution-specific information, and marketing content. If you later decide that you would like to opt out of these communications, please submit your request via the opt-out instructions provided in the communication.

If you opt out of the online recommendation system via the email invitation initiated by the Applicant, you will not receive any Member Institution-specific information concerning the Applicant’s admissions process. We may, however, use your email address, cell phone number, and/or mailing address to send you registration and submission confirmation communications. We may also need to contact you regarding technical support questions we receive from you and/or to provide you with information relevant to the Applicant’s application process. Additionally, Member Institutions may communicate with you regarding the Applicant, using the information you or the Applicant provide.

Targeted online advertising. Our targeted online advertising of Common App’s programs and services may be directed toward existing and prospective Members, existing and potential Applicants, counselors, and recommenders. Common App does not knowingly engage in targeted advertising based on the personal data of children under 18 where prohibited by law, and does not use sensitive personal data for targeted advertising purposes. Some of our Partners that collect information about your activities on or through the Properties may be members of organizations or programs that provide choices to individuals regarding the use of their browsing behavior or mobile application usage for purposes of targeted advertising.

You may opt out of receiving targeted advertising on websites from members of the Network Advertising Initiative by clicking here or the Digital Advertising Alliance by clicking here. Please note that we also may work with companies that offer their own opt-out mechanisms and may not participate in the opt-out mechanisms that we linked above.

In addition, your mobile device settings may provide functionality to limit our, or our partners’, ability to engage in ad tracking or targeted advertising using the Google Advertising ID or Apple ID for Advertising associated with your mobile device.

If you choose to opt out of targeted advertisements, you will still see advertisements online, but they may not be relevant to you.

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To learn more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Choosing not to share your Personal Data. Please note that we may not be able to provide you with certain services if you choose not to share certain Personal Data with us.

Please consult the EU/UK Supplemental Statement and U.S. Supplemental Statement to learn about rights that apply to you if you reside in such jurisdictions.

7. Common App’s Retention Policy

Common App keeps Personal Data about you for as long as necessary to provide you with the Common App service or we have another legitimate reason to retain it, including research purposes, longitudinal studies using aggregate data, or our business purposes. When determining how long to retain your Personal Data, our considerations include our legal obligations under applicable law, other mandatory record keeping requirements, and the likelihood of you needing access to the Personal Data we hold for purposes related to your previous use of the Common App or App.

8. Common App’s Data Security Policies and Practices

Common App follows industry-recognized security practices and standards to protect the personally identifiable information submitted to us, both during transmission and once it’s received. We employ physical, administrative, and technical safeguards designed to promote the security of our systems and protect the confidentiality, integrity, availability, and resilience of Personal Data. Those safeguards include: the pseudonymization and encryption of Personal Data where we deem appropriate; and periodic testing, assessment, and evaluation of the effectiveness of our safeguards.

When Properties are accessed using a supported web browser, Transport Layer Security (TLS) technology protects information using both server authentication and data encryption to help ensure that data are safe, secure, and available only to authorized users.

Your account information is password-protected. We recommend that you do not divulge your password to anyone, that you sign out of your Common App account and close your browser window when you have finished your work, and that you do not copy and paste links from within the online application into an email or share with others on a public forum.

9. Children’s Privacy

Common App’s Properties are not intended for the use of children under the age of 13 or not old enough for us to process their Personal Data without parental or age-specific consent in the place where they live. If you believe we might have collected Personal Data from a child in one of these categories, please contact us at privacy@commonapp.org for us to investigate and delete as appropriate.

Children located in the European Economic Area or in the United Kingdom

We do not process a child’s Personal Data who is located in the European Economic Area or the United Kingdom Personal Data, ages 13 to 15, without the explicit consent of the child’s parent or custodian. We collect this Personal Data to assist our users with the use of our application. Our legal basis for doing this is that it is necessary in order for children from the European Economic Area of the United Kingdom, ages 13 to 15, to use our application.

10. Links to Other Websites

Our Properties may reference or link to other websites or services operated by other organizations that have their own privacy policies, such as Member Institutions. This Policy does not cover the privacy or information practices of those organizations that may be linked to or referenced by the Properties. Please make sure you read the terms and conditions and privacy policy carefully before providing any Personal Data on a website or service operated by another organization, as we do not accept any responsibility or liability for websites or services of other organizations.

11. How You Can Contact Us Regarding This Policy

If you have questions or concerns regarding this Policy, you may contact Common App by email, phone, or mail at the address below:

Privacy Compliance

Attn: Lauren Epps, General Counsel

The Common App, Inc.

3003 Washington Blvd., Ste. 1000

Arlington, VA 22201

privacy@commonapp.org

(703) 348-2887

You may also reach out to us at www.commonapp.org/help or email privacy@commonapp.org to communicate any questions, comments, feedback, or complaints regarding this Policy or the use of Personal Data by the Common App.

U.S. Supplemental Statement

Certain U.S. states provide their residents with certain rights regarding their Personal Data that is collected by businesses. Common App has decided to allow all its customers and other persons in the U.S. to make the same requests, which we call Personal Data Requests (“PDRs”), regardless of whether their place of residence affords them the legal right to make such requests. Common App reserves the right to discontinue this policy at any time, and at its sole discretion, limit PDRs to only those residents of those jurisdictions where privacy laws afford the state residents privacy rights.

This section provides information about the types of Personal Data we collect and disclose to other companies. It also explains how you may make a PDR if you are a US resident.

Before processing your PDRs, we will confirm your identity by requiring you to provide certain information about you and/or your account with us (e.g. name, email, Applicant ID), and you will have to declare that you are who you claim to be.

You may exercise any privacy choice below by submitting a PDR via this link–Contact Common App Support.

  • Request Information About Sharing of Personal Data or Use of Personal Data for Targeted Advertising or Profiling:

    You may request that we disclose the following information to you:

    1. The categories of Personal Data we have collected about you, directly or indirectly, including through or by a service provider or contractor;
    2. The categories of sources from which the Personal Data was collected;
    3. The business or commercial purpose for collecting or selling Personal Data;
    4. The categories of third parties with which we share Personal Data about you, and, if applicable, a list of those specific third parties;
    5. The categories of Personal Data about you that we have sold or shared and the categories of third parties to which the Personal Data was sold or shared;
    6. The categories of Personal Data about you that we disclosed for a business purpose and the categories of third parties to which the Personal Data was disclosed;
    7. The specific pieces of Personal Data we have collected about you; and
    8. If applicable, the result and reasoning underlying any profiling decision we make about you, including actions you could have taken to secure a different decision in the future.
  • If you are an Applicant, you may also save a copy of your application PDF to view the data Common App has collected about you.
  • You have the right to obtain personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.
  • Request Deletion of Personal Data: You may request that we delete any Personal Data about you, and that we notify any service provider, contractor, or third party to delete your Personal Data from its records. Deleting your Common App account does not delete information you previously submitted to Member institutions or Partners, which maintain their own records under their own privacy policies. Your Personal Data may not be deleted under certain circumstances allowed by law, including, but not limited to, where maintenance of your Personal Data is necessary to: complete the transaction for which the Personal Data was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, to provide a good or service that you requested or that is reasonably anticipated within the context of their ongoing business relationship with us, or to otherwise perform a contract between us and you; to detect security incidents, protect against or prosecute fraudulent or illegal activity; to enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us; to comply with a legal obligation; or to otherwise use your Personal Data internally in a lawful manner that is compatible with the context in which you provided that specific data.

    You may also delete your Common App account by sending us an email at privacy@commonapp.org or through your account settings. For more information, please visit our FAQ page, “How can I delete my Common App account?”

    Please note that account deletion is permanent. Once your account is deleted, neither you nor Common App will be able to recover your account or any associated data. As described above, we may retain limited information where the law requires or permits it.

  • Request Correction of Personal Data: You may correct your Personal Data yourself through your Common App account before you submit your application. Once submitted, you will need to contact any Partners or the Member institutions to which you have submitted your application in order to correct your data.
  • Request Opt-Out from Sharing of Personal Data or Use of Personal Data for Targeted Advertising or Profiling: We may use the information we collect from you to engage in targeted advertising or profiling. We do not sell your Personal Data. You may request that we not do the following:
    1. Share your Personal Data with third parties for cross-context behavioral advertising;
    2. Use your Personal Data for targeted advertising;
    3. Use your Personal Data for profiling that produces legal or similarly significant effects concerning you.
  • For ads you see on third-party apps and websites about Common App or Common App Properties, use the Digital Advertising Alliance and the NAI industry opt-outs. Additionally, you may refer to your mobile device settings to determine its functionality to limit our, or our Partner’s, ability to engage in ad tracking or targeted advertising.

    Depending on where you live, in addition to submitting a PDR and the options above, you may have the right to opt out of targeted advertising through a Global Privacy Control (GPC) enabled browser setting. If you have this right, when you visit and log in to our websites in a GPC-enabled browser, we will treat our initial receipt of the GPC signal as a valid request to opt out of targeted advertising, as defined by applicable U.S. privacy laws that grant this right. Please note that our processing of the signal may be limited to the specific browser that you are using. You may need to renew your opt‑out choice if you use a different browser to access our Properties. Other than GPC, we do not recognize any "do not track" signals.

  • Request to Limit the Use and Disclosure of Sensitive Personal Data: In most instances, we do not request the Disclosure of Sensitive Personal Data. You may request that we limit the use of your Sensitive Personal Data. Sensitive Personal Data includes, but is not limited to, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.
  • Appeal a Denial of a Personal Data Request: Should we deny your Personal Data request, you may appeal the denial within 60 (sixty) days from receipt of our decision on your request. If your appeal is denied, we will provide you with an online mechanism, if available, or other method through which you may contact the Attorney General of your state to submit a complaint or express your concerns.

Authorized Agent: You may use an authorized agent to submit a PDR, including through the use of a technology including, but not limited to, an Internet link or a browser setting, browser extension, or global device setting, indicating your intent to opt-out of certain processing of Personal Data. To use an authorized agent, you must provide the agent with a signed authorization. We may require the agent to provide us with proof of the signed authorization. In addition, we may require you to verify your identity with us and directly confirm that you authorized the agent to submit the Personal Data request on your behalf. Such requirements, however, will not apply where you have provided the agent with power of attorney pursuant to applicable state law. Authorized agents may submit Personal Data requests using the same process described above.

Authorized agents may submit Personal Data requests using the same process described above.

Non-discrimination: We will not discriminate against a person because the person exercised a PDR, including, but not limited to:

  1. Denying goods or services to the person;
  2. Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
  3. Providing a different level or quality of goods or services to the person;
  4. Suggesting that the person will receive a different price or rate for goods or services or a different level or quality of goods or services;
  5. Retaliating against an employee, Applicant for employment, or independent contractor for exercising a PDR.

Personal and Sensitive Personal Data Collected, Shared, or Disclosed for a Business Purpose: In the preceding 12 (twelve) months, we may have collected the following categories of Personal Data from the following sources and for the following purposes. We may collect only the Personal Data disclosed below and use the Personal Data we collect only for the purposes disclosed below. We retain this information as long as necessary for business purposes, which includes, but is not limited to, research and development, college application processing, and, for compliance, fraud prevention, and safety. For more information, see above regarding Common App’s Data Retention Policy.

Note: We collect the following information from all collection sources for the business or commercial purposes outlined for each collection source in the chart below: device operating system version, device type and system response times, Internet Protocol (IP) addresses, browser type, Internet Service Provider (ISP), referring/exit pages, date/time stamp, and/or clickstream data.

Category of Personal Data Collected Category of Source of Collection Business or Commercial Purpose of Collection
Name, email address, date of birth, and any other information you decide to share with us.

For more information, please review the “Properties Visitors” section of our Privacy Policy.

 Web Site Visitors
  • To provide, operate and improve our Properties;
  • To respond to your requests, questions and feedback;
  • To analyze and improve our Properties;
  • To provide you with a personalized experience and advertisements;
  • For compliance, fraud prevention, and safety.
Name, home and mailing address, email address, home and cell phone number, date of birth, and information regarding your plans to attend college. Your gender, legal sex, pronouns, military status, race, language proficiency, place of birth, duration of residency in the U.S./other country of residency, citizenship status, and financial status.

Your education, testing, extracurricular and/or community involvement history, and any information you voluntarily provide in your application, including writing samples and essays.

Information about you from recommenders and educational institutions you have attended.

For more information, please see the “Applicants” section of our Privacy Policy.

 Applicants
  • To process your application(s) to our Member Institutions;
  • To allow you to pay fees required for your application to our Member Institutions;
  • To validate the mailing address;
  • To prevent and detect fraud and abuse;
  • To allow our members to meet their institutional reporting requirements regarding certain protected characteristics, we may collect information about you, including your gender, race, ethnicity, sexual orientation.
  • To generate aggregate data for research and product development purposes;
  • To collaborate with third-party researchers on specific research projects, as governed by time-limited data use agreements;
  • To allow you to participate in Common App Programs, such as the Direct Admissions program;
  • To allow you to participate in Partner Programs;
  • Marketing/advertising for Common App products and services;
  • To communicate with you.
Name, marital status, household member information, children, whether the parent is living or dead, occupation, and education level, and number of siblings the Applicant has.

For more information, please see the “Parents/Guardians and Siblings of Applicants” section of our Privacy Policy.

 Parents/Guardians and Siblings of Applicants
  • To communicate with parents or legal guardians for minors so we and our Member Institutions can get evidence of parent or guardian permission.
  • To communicate with parents or legal guardians regarding their applicant’s participation in Common App Programs, such as the Direct Admissions program.
  • To collaborate with third-party researchers on specific research projects, as governed by time-limited data use agreements.
Name and email address

For more information, please see the “College/University Administrators” section of our Privacy Policy

 College/University Administrators
  • To perform the contractual relationship that we have with the Member Institution you work for and Partners.
Name, email address, phone number(s), mailing address(es), zip code, the educational institution you work for, and your position and/or title.

For more information, please see the “School Officials” section of our Privacy Policy.

 School Officials
  • To perform the contractual relationship that we have with the Member Institution you work for.
  • Marketing/advertising
Name, position and/or title, any school code information, email address, phone number(s), mailing address(es), zip code, and your relationship to the applicant.

For more information, please see the “Recommenders” section of our Privacy Policy.

 Recommenders
  • To process applicant submission(s) to our Member Institutions.
  • Marketing/advertising
Name, email address, phone number, address, resume, cover letter, and EEO information (which may include race, gender, sex, preferred pronouns, disability, veteran status, residency, and other Sensitive Personal Data). Employment Applicants
  • To process job application and candidacy for applied position.

EEA/UK GDPR Supplemental Statement

If you are located in the European Economic Area or the United Kingdom, and access our Properties, this EEA/UK GDPR supplemental notice applies to you.

  1. Who is the controller?

    Common App, established at 3003 Washington Blvd, Suite 1000, Arlington, VA, 22203, USA, is the controller of your Personal Data.

  2. What Are Our Legal Bases for Processing Personal Data?

    We use your Personal Data only as permitted by law. Our legal bases for processing the Personal Data described in this Privacy Policy are described below.

    • Performance of a contract
      We process your Personal Data as is necessary to provide the services that you requested from us. For example:
      • We use your information in order to create your account and set you up on our Properties.
      • We use your information to proceed with your application to our Member Institutions.
    • Your consent
      We process certain information based on your consent, which you may revoke at any time. For example:
      • We and our Partners use cookies and similar technologies, as described in more detail in our Cookie Notice;
      • We and our partners rely on your consent to provide you with personalized experience and advertisements based on your activity on our Properties and other websites;
      • When you create a profile, we may process Sensitive Personal Data about you, such as information about your ethnic or racial origin. We will only process such Sensitive Personal Data when you have explicitly consented to it and will only use it to provide you with our services.

      Where we process your Personal Data based on your consent, you may withdraw it at any time. However, this will not affect the lawfulness of our processing before you withdrew your consent. It will also not affect the validity of our processing of Personal Data performed on other lawful grounds.

    • Legitimate Interests
      We may process your information where it is necessary for the purposes of our legitimate interests or our partners’ legitimate interests. In particular, we process your information in furtherance of the following legitimate interests. For example:
      • Keeping our Properties safe and secure: We and our service providers use your information because it is necessary to pursue our legitimate interests in ensuring our Properties are secure, such as implementing and enhancing security measures and protections, protecting against fraud, spam, and abuse, and enforcing our Terms of Use.
      • Providing, improving, and developing our Properties: We and our service providers use your information to provide our Properties, including any personalized services, and to understand and improve our business.
      • Conducting research and studies: We and our service providers/partners use your information to conduct research and studies.
      • Providing ads, and measurement and analytics services: We and our partners use your information to provide personalized ads, and to measure and analyze the success of those ads in order to provide accurate and reliable reporting to our advertisers. We do so as necessary to pursue our legitimate interests and our partners’ legitimate interests in marketing and monetizing our services.
    • Legal Obligation
      We may process your information in order to comply with a legal obligation, a court order, or to exercise and defend legal claims. For example:
      • We may preserve and disclose your information if it is necessary to respond, based on applicable law, to a valid legal request (e.g., a subpoena, search warrant, court order, or other binding request from government or law enforcement); and
      • We may retain and process your information where it is necessary for compliance with applicable laws.
  3. Your rights

    You have the following rights in relation to the Personal Data we hold about you:

    • Right of access: You can ask us to provide you with information about our processing of your Personal Data and give you access to your Personal Data;
    • Right to rectification: If the Personal Data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified;
    • Right to erasure: You can ask us to delete or remove Personal Data where there is no lawful reason for us continuing to store or process it, where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons that will be notified to you, if applicable, at the time of your request;
    • Right to restrict processing: You can ask us to suspend the processing of your Personal Data if, (i) you want us to establish the data's accuracy; (ii) where our use of the data is unlawful but you do not want us to erase it; (iii) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
    • Right to object: Where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.
    • Right to data portability: You have the right, in certain circumstances, to ask us to provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
    • Right to withdraw consent at any time: Where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
  4. Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the Personal Data or where certain exemptions apply. To exercise any of these rights, please contact us using the contact details provided above.

    Although we urge you to contact us first to resolve any concerns you may have, you always have the right to lodge a complaint with your competent data protection authority.

  5. How Do We Protect Personal Data if we transfer it internationally?

    We may transfer your Personal Data outside of the EEA and/or UK. Some of these recipients are located in countries in respect of which either the European Commission and/or UK Government (as and where applicable) has issued adequacy decisions, in which case, the recipient’s country is recognized as providing an adequate level of data protection under UK and/or European data protection laws (as applicable) and the transfer is therefore permitted under Article 45 of the GDPR.

    Some recipients of your Personal Data may be located in countries outside the EEA and/or the UK for which the European Commission or UK Government (as and where applicable) has not issued adequacy decisions in respect of the level of data protection in such countries (“Restricted Countries”). Where we transfer your Personal Data to a recipient in a Restricted Country, we will either:

    • enter into appropriate data transfer agreements based on so-called Standard Contractual Clauses approved from time-to-time under GDPR Art. 46 by the European Commission, the UK Information Commissioner’s Office or UK Government (as and where applicable); or
    • rely on other appropriate means permitted by the EU/UK GDPR, which establish that such recipients will provide an adequate level of data protection and that appropriate technical and organizational security measures are in place to protect Personal Data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing.
  6. You may request a copy of such appropriate data transfer agreements by contacting us using the contact details above.