Substack's updated privacy policy adds disclosure that it shares account identifiers with child safety industry consortia to detect child sexual exploitation and abuse. The policy also establishes a one-month response commitment for privacy rights requests, adds a right to object to certain processing (including content personalization), clarifies that material changes to the policy will be notified, and modifies language about direct message retention to note that platform restrictions may apply while recipients may still retain messages independently.
Consumers: When you ask Substack for your data or to exercise a privacy right, they will respond within one month instead of an unspecified timeframe.
Consumers: You can tell Substack to stop using your data for personalization and other legitimate-interest purposes, and they must stop unless they can show a compelling reason to continue.
Consumers: Substack now explicitly tells you that it shares your email address and username with child safety organizations to detect child abuse material.
The updated policy discloses that Substack shares account identifiers (email addresses and usernames) with trusted child safety organizations to detect and prevent online child sexual exploitation and abuse. Users now have the right to object to processing of their personal information for personalization purposes on grounds relating to their particular situation, and Substack commits to responding to privacy rights requests within one month. The policy also clarifies that while recipients of direct messages may retain them independently, the platform may restrict your access to messages when other users delete or block you. You can exercise your right to object to personalization processing by contacting privacy@substackinc.com.
→ Review the updated privacy policy to understand how your account identifier is shared with child safety consortia.
→ Contact privacy@substackinc.com if you wish to object to processing of your personal information for personalization purposes.
Substack now discloses sharing of account identifiers with trusted child safety organizations for CSAM detection and prevention.
Substack commits to respond to privacy rights requests within one month, extendable by two months with notice.
Users can object to processing based on legitimate interests, including personalization, and Substack must cease processing unless compelling grounds override the objection.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
Substack has added explicit disclosure of account identifier sharing with child safety consortia for CSAM detection, established a one-month response commitment for privacy rights requests, and introduced a right to object to processing based on …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-001590.
Substack updated its Terms of Use effective October 6, 2026, adding new sections on content moderation procedures, clarifying dispute resolution, …
Substack replaced AdQuick, a third-party analytics tracking pixel, with muxData for video metric collection. The change shifts from pixel-based tracking …
Substack expanded its privacy policy to disclose that it obtains additional information from third parties and sources beyond what it …
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.