The policy states that personal information may be shared or transferred in connection with a merger, asset sale, financing, or acquisition of Medium, including during the negotiation phase of such transactions, with user notification described as prominent notice or direct communication.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that personal data may be disclosed to prospective acquirers or transaction counterparties prior to deal completion, which creates data exposure outside Medium's direct operational relationships and may engage GDPR requirements for lawful transfer basis during pre-transaction due diligence.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Removal of explicit merger and acquisition data transfer language means the current policy no longer clearly discloses how user data will be handled in business sale or acquisition scenarios, potentially weakening transparency around this significant use case.
View full change record →Removed specific scenarios (financing due diligence, reorganization, bankruptcy, receivership, transition of service) and affiliate entity references, now covers only mergers, asset sales, and acquisition scenarios.
View full change record →The agreement authorizes transfer of personal information to third parties involved in corporate transactions, including during negotiation phases, which may result in personal data being processed by entities not yet bound by Medium's privacy commitments.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.Excerpt from Medium's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that personal data may be disclosed to prospective acquirers or transaction counterparties prior to deal completion, which creates data exposure outside Medium's direct operational relationships and may engage GDPR requirements for lawful transfer basis during pre-transaction due diligence.
The agreement authorizes transfer of personal information to third parties involved in corporate transactions, including during negotiation phases, which may result in personal data being processed by entities not yet bound by Medium's privacy commitments.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.