Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes sharing of personal information with third-party vendors and service providers for purposes including payment processing, data analysis, email delivery, hosting, customer service, and marketing, without specifying a complete list of named providers or requiring user notification prior to each sharing event.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the contractual basis under which Medium transfers personal data to external parties for operational purposes, which implicates GDPR Article 28 data processor agreement requirements and CCPA business-purpose sharing disclosure obligations.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Provision now explicitly mentions use of personal information for ML model training and includes reference to 'information you submitted or posted,' significantly expanding the scope of data sharing purposes.
View full change record →Language simplified and narrowed to remove explicit mention of fraud prevention and business partners, consolidating focus on service providers only.
View full change record →Under this clause, personal information including identifiers and behavioral data may be transferred to third-party vendors for analytics, marketing, and infrastructure purposes, with disclosure limited to categorical description rather than named recipients.
How other platforms handle this
The right to know with whom we have shared your Personal Data, for what purposes, and what Personal Data has been shared (including whether Personal Data was disclosed to third parties for their own direct marketing purposes)
You can limit to what extent we use your personal information for these purposes.
If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).
Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We may share your personal information with third party vendors and service providers that perform services for us or on our behalf, such as payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance.Excerpt from Medium's Privacy Policy
1. REGULATORY LANDSCAPE: GDPR Article 28 requires that data transfers to processors be governed by a written data processing agreement specifying processing scope and obligations. CCPA requires disclosure of categories of third parties with whom personal information is shared. The FTC Act applies to accuracy of third-party sharing disclosures for US users. 2. GOVERNANCE EXPOSURE: Medium. The policy does not name specific third-party service providers or provide a current vendor list, which may complicate GDPR Article 30 Records of Processing Activities documentation and CCPA response workflows for data subject requests. 3. JURISDICTION FLAGS: EU and EEA users are subject to heightened exposure because GDPR Article 28 data processing agreements must be in place with all processors; the policy does not confirm this. California users are entitled under CCPA to know categories of third parties receiving their data, which the policy addresses at a categorical level. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Medium for enterprise publishing or content distribution should assess whether Medium's vendor relationships and associated data flows are documented in a way that satisfies their own GDPR data processor assessment obligations. The policy does not assert audit rights over sub-processors. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should request Medium's current data processor list or Sub-Processor List if available, to support ROPA and vendor risk assessments. CCPA compliance programs should verify that Medium's categorical disclosures align with current sharing practices.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the contractual basis under which Medium transfers personal data to external parties for operational purposes, which implicates GDPR Article 28 data processor agreement requirements and CCPA business-purpose sharing disclosure obligations.
Under this clause, personal information including identifiers and behavioral data may be transferred to third-party vendors for analytics, marketing, and infrastructure purposes, with disclosure limited to categorical description rather than named recipients.
ConductAtlas has identified this type of provision across 294 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.