The policy states that for EEA users, Medium processes personal data on the legal bases of consent, contract performance, legitimate interests, or legal obligation under GDPR, without specifying in the policy text which legal basis applies to each individual processing activity.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the claimed legal bases for EEA data processing, but the absence of a processing activity-level mapping to specific legal bases may present a compliance gap relative to GDPR accountability and transparency requirements enforced by EU supervisory authorities.
Interpretive note: The policy asserts legitimate interests as a legal basis without specifying which processing activities it covers, creating ambiguity about the scope of EEA users' right to object under GDPR Article 21.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Provision removes EEA-specific language and restructures the lawful bases explanation with specific examples; notably adds 'conduct data analytics' as an explicit legitimate interest example.
View full change record →Shifted focus from user rights (access, rectify, erase, restrict, portability, object) to Medium's legal bases for processing data, fundamentally changing the provision's perspective.
View full change record →Under this clause, EEA users' personal data is processed under one of four stated legal bases; however, the policy does not specify which basis applies to each processing activity such as behavioral tracking or marketing, which affects EEA users' ability to identify and exercise relevant data subject rights such as the right to object or withdraw consent.
How other platforms handle this
to withdraw your consent to our processing of your data (where such processing is based on consent)
Request Restriction or Object to Processing of your information.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
"If you are in the European Economic Area (EEA), we only process your personal data when we have a valid legal basis to do so, including when: (a) you have consented to the processing; (b) the processing is necessary to perform a contract with you; (c) we have a legitimate interest in processing your data; or (d) we are required to process your data to comply with a legal obligation.Excerpt from Medium's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the claimed legal bases for EEA data processing, but the absence of a processing activity-level mapping to specific legal bases may present a compliance gap relative to GDPR accountability and transparency requirements enforced by EU supervisory authorities.
Under this clause, EEA users' personal data is processed under one of four stated legal bases; however, the policy does not specify which basis applies to each processing activity such as behavioral tracking or marketing, which affects EEA users' ability to identify and exercise relevant data subject rights such as the right to object or withdraw consent.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.