If you live outside the US, your personal data will be sent to and stored in the United States, where privacy laws may offer less protection than in your home country.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Users in the EU and other countries with strong data protection laws should be aware that their data is transferred to a jurisdiction where equivalent legal protections may not apply, which affects what remedies are available if data is mishandled.
Interpretive note: The policy does not specify which GDPR-compliant transfer mechanism Medium relies upon, creating uncertainty about the adequacy of the legal basis for EU data transfers.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →This provision means that personal data collected from non-US users, including EU residents, is processed in the United States without a guarantee of equivalent legal protections, which may limit the practical enforceability of rights granted under laws like GDPR.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Medium is headquartered in the United States, and we have operations and service providers in the United States and throughout the world. If you are located outside of the United States, please be aware that information we collect, including personal data, will be transferred to, and processed, stored, and used in the United States and other jurisdictions. Data protection laws in the United States and other jurisdictions may differ from those in your country of residence.Excerpt from Medium's Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V, which governs transfers of personal data to third countries.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Users in the EU and other countries with strong data protection laws should be aware that their data is transferred to a jurisdiction where equivalent legal protections may not apply, which affects what remedies are available if data is mishandled.
This provision means that personal data collected from non-US users, including EU residents, is processed in the United States without a guarantee of equivalent legal protections, which may limit the practical enforceability of rights granted under laws like GDPR.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.