Substack updated its privacy policy on May 15, 2026 to disclose that it shares account identifiers with child safety industry consortia and now receives information from those consortia to detect child sexual abuse material (CSAM). The policy also added language stating that Substack may obtain additional information from third parties, combine it with platform data, and use the combined information to provide safer experiences and improve the platform and analytics.
The updated policy discloses that Substack shares account identifiers with child safety industry consortia and receives information from those consortia to detect CSAM. The policy now also states that Substack may obtain additional information from third parties and combine it with platform data to provide safer experiences and improve platform analytics. The updated terms treat combined information from other sources in accordance with the overall privacy policy. These are disclosures of existing or new data-handling practices rather than changes that grant users new control mechanisms.
The updated policy establishes explicit disclosure of data sharing with child safety consortia and third-party data integration practices. These disclosures clarify how Substack processes account identifiers and other information for safety purposes and platform improvement, which affects what data handling users should expect when using the platform.
Policy now states Substack shares account identifiers with and receives information from child safety industry consortia to detect CSAM.
Policy adds that Substack may obtain information from third parties, combine it with platform data, and use combined information for safety and analytics purposes.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Substack disclosed two changes to its data-handling practices on May 15, 2026: bidirectional data sharing with child safety consortia for CSAM detection, and third-party data integration for safety and analytics purposes. The CSAM disclosure aligns with industry practice and regulatory expectations under NCMEC standards and FOSTA-SESTA frameworks. The third-party data integration disclosure appears standard for content platforms. No material compliance obligation changes are created by the disclosure itself, but organizations that serve Substack users should evaluate whether their own privacy notices adequately reflect that platform data may be combined with third-party sources before use in their systems.
FOSTA-SESTA (US federal law requiring platforms to report CSAM and develop detection programs), NCMEC CyberTipline protocols, COPPA (if minors are users), GDPR Article 6 (lawful basis for processing) and Article 14 (information to be provided where data not obtained from data subject), CCPA (California residents' right to know sources of personal information), state child safety laws (varying by jurisdiction).
Full compliance analysis
Obligation analysis, escalation trigger, board language, and recommended action.
Watcher: regulatory citations + obligations. Professional: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-002116.
See the full side-by-side comparison of every sentence added, removed, and modified.
🔒 Full diff — WatcherThe navigation footer of Substack's privacy policy page was updated on May 19, 2026 to include comparative product links. Specifically, …
Substack's Terms of Use footer navigation was updated on May 19, 2026 to add comparative product links. The footer now …
Substack's privacy policy now discloses that the company shares account identifiers with child safety industry consortia to detect child sexual …
Get alerted when this policy changes again — including what changed and why it matters.
Prefer a weekly summary instead?
Get the biggest policy changes across 320+ platforms every Sunday.