Does Canvas detect ChatGPT? What it logs and shows
No. Canvas has no AI detector of its own, and nothing inside it reads your sentences and scores them. What Canvas keeps is a request log. It records which addresses your account asked for and when, from which browser, how long a quiz took, and when a file arrived. Instructure prints the warning itself, twice on one page, that quiz logs should not be used to identify cheating. Where an AI percentage does appear in Canvas, a separate company put it there.
Canvas has no detector of its own
Canvas is where you hand things in. Instructure has been shipping AI into it since 2025, and none of it reads a submission and returns an AI score. The July 2025 launch announcement for IgniteAI, Instructure's AI layer for Canvas, lists quiz creation, rubric generation, discussion summaries, outcome alignment, grading and feedback assistance, translation, and an agent that drives Canvas workflows from a prompt. Detection is not on the list, and it has not appeared on a later one.
When an AI percentage does show up next to a submission in Canvas, a different company computed it. Instructure's own plagiarism detection platform documentation spells out the arrangement. Enabling a plagiarism tool on an assignment creates a webhook subscription; the tool provider reads the submission through the Canvas submissions API; "after processing the submission, an Originality Report may be created for the submission"; and the provider sends that report back into Canvas through the Originality Report API. The judgement happens on the vendor's servers. Canvas stores the number and draws it beside the file.
So the question splits in two, and only one half is about Canvas. What does Canvas itself know about how you worked? And what does the tool bolted onto it know about your text? The first half has a documented answer, and it is smaller than most people assume.
What it keeps about you is a server log
Every page you open in Canvas becomes a page view record. The Canvas API documentation lists exactly what one holds: the URL requested, the controller and action that served it, "an approximation of how long the user spent on the page, in seconds", the user agent of the browser, the origin IP address, the session identifier, the HTTP method, and whether the request counted as participating.
Read the list again for what is missing. Nothing about what you typed. Nothing about your clipboard. Nothing about the other tabs open beside Canvas. Nothing about the machine beyond the browser's own user-agent string. A page view says that an address was requested at a time, and that is the whole of its vocabulary. It is a web server log, and a web server log cannot be anything else.
Instructure attaches a caution to it on the same page, in its own words: "The data is a best effort attempt, and is not guaranteed to be complete or wholly accurate. This data is meant to be used for rollups and analysis in the aggregate, not in isolation for auditing, or other high-stakes analysis involving examining single users or small samples." The reason given is that page views are assembled from log files rather than from a transactional database, so records can be lost and duplicated on the way.
The four things an instructor can open
There is no hidden console. An instructor with normal course permissions has four places to look, each documented in the Canvas instructor guide, and each narrower than its reputation.
| What they open | What it shows | What Instructure says about it |
|---|---|---|
| People page, Last Activity | The date and time of your most recent interaction in the course | Updates on navigation, discussion replies, submissions and file access. "Mobile actions may not display due to local device caching." |
| People page, Total Activity | How long you interacted with the course, as hours and minutes | It "counts page navigation only", records only time that "exceeds two minutes", and treats any gap under ten minutes as activity. |
| Course access report | Each piece of content, times viewed, times participated, last viewed | "A view is counted each time a user navigates to the URL where the content resides or downloads an attachment." |
| Quiz log | A status and a timestamp for every action in one quiz attempt | "Quiz logs should not be used to validate academic integrity or identify occurrences of cheating." |
Total Activity is the number most likely to be quoted at a student, and it is a guess about attention rather than a measurement of it. It counts page navigation, it treats any gap under ten minutes as continuous work, and it has no idea whether you were reading the page or had left it open while you cooked dinner. Someone who drafts in Word and pastes at the end registers almost nothing. Someone who leaves an assignment page open in a background tab registers hours. Both of those, per the People page documentation, are working as designed.
The access report is the same shape. A participation is a concrete act, "posting to a discussion or submitting an assignment". A view is a request for a URL. If a course page auto-refreshes, or a link preloads, or a browser restores a tab on startup, that is a view. If you read a printed handout for three hours, that is nothing.
Quiz logs carry their own warning
Quiz Log Auditing is an opt-in course feature, so it is not always on. Where it is, the log opens from a student's quiz results and shows the session start time, then a status and a timestamp for each action. The instructor guide gives the whole vocabulary: "Viewed (and possibly read) a question", "Answered a question", "Stopped viewing the Canvas quiz-taking page", and "Resumed".
The third one is what ends up quoted in accusation emails. The guide says it "displays when a student navigates away from the quiz (closes the browser tab, opens a new browser tab, or navigates to a different program)". Note what that sentence does not separate. A chatbot, a calculator, a notification, a second monitor, a stray click on the dock and a laptop going to sleep all produce the same line in the log.
Instructure states the limit twice on that page. In the introduction: "Quiz logs are not intended to validate academic integrity or identify cheating for a quiz." In the notes: "Quiz logs should not be used to validate academic integrity or identify occurrences of cheating." It also tells instructors who suspect misconduct to "first work with the academic affairs office, academic technology office, or other office charged with handling academic misconduct matters within your institution" rather than start from the log.
Two facts from the same page are worth carrying around. Quiz logs "are only retained for six months", so if a log is ever going to matter to you, it has to be saved early. And the log misreports its own order for four question types: autosave marks Fill-in-Multiple-Blanks, Matching, Multiple Answers and Multiple Dropdown questions as answered the moment a student clicks any other question, so entries "may appear earlier in the quiz log than the order in which the student intentionally answered the questions".
None of this is theoretical. In 2021 more than a dozen students at Dartmouth were accused on the basis of Canvas activity data, and the university ended the investigation and dismissed every allegation. The Electronic Frontier Foundation and the Foundation for Individual Rights in Education had already argued that the logs were being misread, because a device can ping files without anyone deciding to open them. Instructure published its own position a few months later, in November 2021: "data derived from Canvas will be a limited, decontextualized fragment of total student behavior", and "recognize that data from Canvas can only ever tell part of a student's story".
A submission is text, a timestamp and an attempt number
Here is the part that answers the question people are really asking. The Canvas submission record holds the attempt number, the body ("the content of the submission, if it was submitted directly in a text field"), the submission type, the timestamp when the assignment was submitted, and whether it was late. Plus grades, comments and a preview URL once marking starts.
That is the record. Typing an essay into the text box over three hours and pasting it in at 23:58 produce the same row, differing only in the timestamp. There is no keystroke history, no draft trail inside the box, no paste event. Canvas is not in the room while you write, because you are not writing in Canvas.
Upload a file instead and Canvas keeps the file and renders it for marking. The metadata inside that file is a separate question and a real one, since a document carries its own authoring history whether or not anyone looks, which is the subject of how to check a document for hidden marks. Every attempt is kept, too, so an instructor can open what you submitted at the second attempt and what you submitted at the first.
Where Turnitin plugs in
Turnitin is not part of Canvas. It is one of the tool providers the plagiarism framework was built for. An instructor switches it on for a Canvas assignment, the submission travels to Turnitin, Turnitin computes the similarity score and, where the institution licenses and enables it, the AI writing indicator, and the result comes back for the instructor to read in SpeedGrader.
What follows from that is simple and useful. The AI number you see inside Canvas is a Turnitin number. Everything that is known about how it behaves, where it misfires and what it does not claim is known about Turnitin, and none of it is a fact about your learning platform. If that is the number in front of you, start with what a Turnitin AI score actually measures and what the detector does with ChatGPT text. Whether your institution shows that indicator at all is a local decision, and several have turned it off: see the universities that switched AI detection off.
What none of it can see
Collect the documentation and the gaps line up in one direction.
- Another tab. Canvas records requests made to Canvas. A chatbot, a search engine, a PDF in your downloads folder and a group chat are all invisible to it. A quiz log can say you left the page. It cannot say where you went.
- Typing against pasting. There is no field in the submission record for either, so nothing distinguishes them.
- Who was at the keyboard. A session identifier and an IP address identify a browser session, not a person.
- Whether a click was a click. This is the Dartmouth point, and it is the one Instructure makes itself. Automatic requests, preloads and restored tabs land in the log exactly as deliberate visits do.
- Reading you did elsewhere. The library article that changed your argument is not a Canvas page view, so a thoughtful student and an absent one can look identical.
The software that really does keep a fine-grained record of writing is not the place you hand work in. It is the editor you write in, and if that editor is a Google Doc, the record is far more detailed than the one in Canvas. That is the subject of what version history shows when you paste, and it cuts both ways.
The record that does answer the question
Canvas cannot show that you wrote your paper, and it cannot show that you did not. What can is the account of how the paper came to exist, and you are the only person who can build that while you work. A history with real sessions and false starts in it. The sources you actually opened. A quote under each claim that anyone can check in a minute, which also protects you from the failure that gets people into far worse trouble than a detector score, references that do not exist. If you want the full version of that argument, how to prove you didn't use AI is it, and what to do when you are accused is the one to read tonight if this is already happening. Our free citation checker will open every reference in a list and tell you which ones resolve.