The policy states that personal information may be transferred to and stored on computers outside a user's home jurisdiction, including to jurisdictions with less protective privacy laws, without specifying the transfer mechanisms used to safeguard EEA personal data.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy's disclosure of cross-border data transfers without specifying the legal mechanism used for EEA transfers, such as Standard Contractual Clauses or an adequacy decision, creates a compliance documentation gap relevant to GDPR Chapter V requirements enforced by EU supervisory authorities.
Interpretive note: The policy does not specify which GDPR-compliant transfer mechanism is relied upon for EEA personal data transferred to the United States, creating ambiguity about the legal basis for such transfers.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Updated provision now specifies Medium's US headquarters, names Amazon Web Services as a specific data processor, and uses 'equivalent' instead of 'as protective' language, providing more concrete transparency about cross-border transfers.
View full change record →Simplified provision by removing company headquarters/operations details and broadening from US-specific focus to any cross-border transfer with weaker privacy protections.
View full change record →The agreement establishes that personal information including identifiers and behavioral data may be transferred and stored outside a user's home jurisdiction; for EEA users, the applicable transfer safeguard mechanism is not specified in the policy text.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Your personal information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction.Excerpt from Medium's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy's disclosure of cross-border data transfers without specifying the legal mechanism used for EEA transfers, such as Standard Contractual Clauses or an adequacy decision, creates a compliance documentation gap relevant to GDPR Chapter V requirements enforced by EU supervisory authorities.
The agreement establishes that personal information including identifiers and behavioral data may be transferred and stored outside a user's home jurisdiction; for EEA users, the applicable transfer safeguard mechanism is not specified in the policy text.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.