Medium keeps your personal data for as long as it considers necessary to run its services, without committing to specific deletion timelines in most cases.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Without fixed retention periods, your data could be held for an extended time after you stop using Medium, and you may need to actively request deletion to ensure your information is removed.
Interpretive note: The absence of specific retention periods creates ambiguity about how long different categories of data are held, and GDPR compliance of this provision depends on whether Medium's internal retention schedules satisfy the storage limitation principle.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Medium does not commit to specific timeframes for deleting most categories of your personal data, meaning your account information, reading history, and other data may be retained indefinitely unless you actively request deletion.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain personal information for as long as necessary to provide you with our services and for the other purposes set out in this Privacy Policy. In some cases, we may retain personal information for longer periods as required by law or for legitimate business purposes.Excerpt from Medium's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Article 5(1)(e), which requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary for the purposes for which it …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Without fixed retention periods, your data could be held for an extended time after you stop using Medium, and you may need to actively request deletion to ensure your information is removed.
Medium does not commit to specific timeframes for deleting most categories of your personal data, meaning your account information, reading history, and other data may be retained indefinitely unless you actively request deletion.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.