Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that account data is deleted within 14 days of account closure, but that certain information may be retained beyond this period as required by law or for legitimate business purposes, without specifying which data categories or retention durations apply.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a 14-day account data deletion timeline upon account closure but includes a carve-out for retention required by law or legitimate business purposes, the scope of which is not defined in the document.
Interpretive note: The policy does not specify which data categories are retained beyond the 14-day account deletion window or the applicable retention durations, making the full scope of this provision ambiguous.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Under this clause, users who delete their Medium account can expect account data to be removed within 14 days, but the agreement reserves the right to retain unspecified categories of information for legal or business purposes beyond that period.
Cross-platform context
See how other platforms handle Data Retention and Account Deletion and similar clauses.
Compare across platforms →Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We store personal data associated with your account for as long as your account remains active. If you close your account, we will delete your account data within 14 days. We store other personal data for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations. Please note that if you choose to delete your account, we may continue to retain certain information about you as required by law or for our legitimate business purposes.Excerpt from Medium's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 5(1)(e) (storage limitation) and Article 17 (right to erasure) for EEA and UK users, as well as CCPA deletion rights for California residents. Enforcement authorities include national Data Protection Authorities and the California Privacy Protection Agency. The retention carve-out for 'legitimate business purposes' may require evaluation under GDPR's storage limitation principle, which requires that data be kept no longer than necessary for the specified purpose. 2) GOVERNANCE EXPOSURE: Medium. The undefined scope of the legitimate business purposes retention carve-out creates potential exposure under GDPR's storage limitation and erasure rights requirements. The failure to specify which data categories are retained beyond 14 days and for how long may not satisfy the granularity expected under GDPR Article 13/14 disclosure requirements. 3) JURISDICTION FLAGS: EEA and UK users have enforceable erasure rights that may be constrained by the breadth of the retention carve-out. California residents have CCPA deletion rights subject to similar legal obligation exceptions. The provision applies globally, but jurisdictional protections vary. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations that process personal data through Medium on behalf of data subjects should assess whether Medium's retention practices are compatible with their own data retention schedules and deletion obligations. Where Medium retains data beyond account closure, this may affect data mapping and Records of Processing Activities. 5) COMPLIANCE CONSIDERATIONS: Legal teams should request clarification from Medium regarding which specific data categories are retained after account deletion and the applicable retention periods, to confirm compatibility with GDPR Article 5(1)(e) and CCPA. Internal data mapping updates should reflect that Medium may retain certain user data beyond the 14-day account deletion window.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a 14-day account data deletion timeline upon account closure but includes a carve-out for retention required by law or legitimate business purposes, the scope of which is not defined in the document.
Under this clause, users who delete their Medium account can expect account data to be removed within 14 days, but the agreement reserves the right to retain unspecified categories of information for legal or business purposes beyond that period.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.