Mathway, LLC (owned by Chegg, Inc.)

Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

• PARENT COMPANY (CHEGG) COMPLIANCE HISTORY: Chegg, which owns Mathway, was subject to an FTC enforcement order in January 2023 for lax data security practices. The order cited 4 data breaches (2017-2018) affecting 40 million customers; failures included lack of encryption, no multi-factor authentication, no security monitoring, and no written security policy until Jan 2021. Mathway users' data security is thus under the governance of a company with documented security failures.
• RECENT FTC SETTLEMENT: Chegg paid $7.5 million in September 2025 to settle FTC allegations of unlawful subscription cancellation practices and deceptive billing. This settlement demonstrates ongoing regulatory compliance issues affecting the parent company and potentially Mathway's subscription practices.
• ZERO SECURITY CERTIFICATIONS: Mathway does not disclose any SOC 2, ISO 27001, ISO 27017, ISO 27018, GDPR, HIPAA, PCI DSS, or FedRAMP certifications. The security page only discusses a past 2020 breach; no trust center or compliance documentation exists.
• AI TRAINING TRANSPARENCY GAP: Mathway markets itself as 'AI-powered' but does not disclose in its privacy policy or terms whether customer data (math problems, solution attempts, user interactions) is used to train or refine the underlying AI models. For an AI product, this is a critical transparency omission. No opt-out mechanism mentioned.
• GDPR TRANSPARENCY: Privacy policy mentions EU/EEA/UK residents have specific rights but the relevant section (Section 12) is truncated/incomplete in the available documentation. Full GDPR compliance posture unclear.
• CONSUMER TRUST ISSUES: Trustpilot rating of 1.7/5 with complaints about unauthorized charges, subscription cancellation difficulty, and customer service responsiveness. Consistent with parent company's FTC settlement for cancellation practices.
• NO DATA PROCESSING AGREEMENT: No DPA is publicly offered. Privacy contact is generic (privacy@chegg.com) with no mention of enterprise contracts or legal data processing agreements.
• DATA SHARING SCALE: Policy discloses sharing with 794 partners for advertising, analytics, and marketing; full scope of data categories shared with each partner not specified.
• HIPAA NOT IN SCOPE: While Mathway could theoretically be used by educators in healthcare settings, the product does not claim HIPAA compliance and should not be relied upon for healthcare-regulated data.