Substack updated its privacy policy on May 5, 2026 to disclose that it shares account identifiers with child safety organizations to detect child sexual abuse material, added a one-month deadline for responding to privacy rights requests, and clarified that direct message recipients may retain messages even after deletion. The policy also now specifies that only material changes to the privacy policy will trigger user notification.
Consumers: You are now told that Substack shares your email and username with industry groups working to prevent child abuse online.
Consumers: When you ask Substack for your data or to exercise a privacy right, you now have a guaranteed timeline for their response instead of an indefinite wait.
Consumers: Substack is now clearer that even if you delete a message or your account, the person you sent it to can keep it forever.
Substack now discloses that it shares account identifiers, such as email addresses and usernames, with trusted industry child safety organizations to detect and prevent online child sexual exploitation and abuse. The policy also establishes that Substack will respond to privacy rights requests within one month, or up to three months for complex requests, providing more certainty about response timelines. Additionally, the policy clarifies that direct message recipients may retain messages even if you request deletion or delete your account, which is now explicitly stated rather than implied.
ConductAtlas has recorded 2 material changes to this document (since April 2026).
Substack now explicitly states it shares account identifiers with child safety organizations to detect and prevent online child sexual exploitation and abuse.
Substack commits to respond to privacy rights requests within one month, or up to three months for complex requests, with notification of extension.
Policy now clarifies that platform may restrict message access but recipients may retain messages indefinitely, regardless of user deletion or account closure.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
This change introduces a new disclosure about data sharing for child safety purposes and establishes formal response timelines for data subject rights requests. The child safety sharing disclosure engages GDPR Article 6 (lawful basis), CCPA …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-001590.
Substack's privacy policy included a navigation menu item referencing 'For media founders' in its updated version published June 28, 2026. …
Substack updated its navigation menu on June 28, 2026 by adding 'For media founders' to its list of creator categories. …
Substack updated its privacy policy footer on June 16, 2026 to add a reference to 'Brand Partnerships' in the navigation …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.