Medium Privacy Policy

This document is Medium's Privacy Policy (effective March 24, 2022), governing the collection, use, and sharing of personal data by A Medium Corporation across its publishing platform, and operates on a consent and legitimate interest basis depending on jurisdiction. The policy states that Medium collects account registration data, usage data, payment information, location data, and third-party linked account data, and the terms authorize sharing this information with service providers, business partners, affiliated entities, and in connection with mergers or acquisitions. Notably, the policy asserts broad data retention and third-party sharing rights, including the use of third-party analytics and advertising partners, and permits transfer of personal data to the United States and other jurisdictions that may lack equivalent data protection laws, which is a standard but practically significant disclosure for international users. The policy engages GDPR for EU/EEA users (including specific rights to access, erasure, and objection), CCPA for California residents (including rights to know, delete, and opt out of certain data sharing), and COPPA in the context of age restrictions; enforcement oversight would fall primarily under the FTC at the federal level and applicable state attorneys general. Material compliance considerations include the adequacy of consent mechanisms for EU transfers, the sufficiency of the CCPA opt-out infrastructure, and whether third-party advertising and analytics integrations are disclosed with sufficient specificity to satisfy applicable transparency requirements.