Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that California residents hold rights under CCPA to know about, delete, and opt out of the sale of their personal information, and have a right to non-discrimination for exercising these rights, with opt-out available via a designated link.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational mechanisms through which California residents can exercise CCPA and CPRA rights, including the opt-out of data sale or sharing, which is a concrete and time-sensitive entitlement available to a defined user population.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Current version explicitly states 'Medium does not sell your personal information' but reserves the right to do so in the future, a significant change from the previous version's straightforward CCPA rights description.
View full change record →Added explicit mention of the right to non-discrimination for exercising privacy rights, which is a key CCPA provision previously omitted.
View full change record →The agreement establishes that California residents can request disclosure, deletion, or cessation of sale or sharing of their personal information, and that exercising these rights may not result in discriminatory treatment such as denial of service or pricing differences.
How other platforms handle this
When you exercise any of your applicable legal rights to access, amend, or delete your personal information, we may request additional information from you for the purpose of confirming your identity.
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
California residents under the age of 18 who are registered users of online sites, services, or applications have a right under California Business and Professions Code Section 22581 to remove, or request and obtain removal of, content or information they have publicly posted.
Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), including the right to know about personal information collected, disclosed, or sold; the right to delete personal information; the right to opt-out of the sale of your personal information; and the right to non-discrimination for exercising your privacy rights.Excerpt from Medium's Privacy Policy
1. REGULATORY LANDSCAPE: The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA, effective January 1, 2023) requires businesses meeting applicable thresholds to honor the described rights. The California Privacy Protection Agency (CPPA) and California Attorney General have enforcement authority. The policy's reference to the right to opt out of 'sale' should be evaluated against CPRA's expanded definition of 'sharing' for cross-context behavioral advertising. 2. GOVERNANCE EXPOSURE: Medium. The policy's CCPA disclosures must accurately reflect Medium's current data practices, including whether data is 'shared' for cross-context behavioral advertising under CPRA's expanded definition, not merely 'sold' under the original CCPA definition. Any gap between disclosed and actual practices creates enforcement exposure. 3. JURISDICTION FLAGS: California residents have primary exposure. Other US states with comprehensive privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA) may create parallel rights obligations not explicitly addressed in this policy. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations that are California-covered businesses and use Medium as a service provider should confirm that Medium's CCPA service provider or contractor agreements are in place and that Medium does not retain, use, or disclose personal information outside the business purpose for which it was shared. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Medium's opt-out mechanism is accessible, functional, and honored within the CCPA-required 15-business-day response period. CPRA updates require that 'sharing' for cross-context behavioral advertising be included in opt-out mechanisms, and legal teams should confirm that Medium's opt-out link covers both sale and sharing as defined under CPRA.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the operational mechanisms through which California residents can exercise CCPA and CPRA rights, including the opt-out of data sale or sharing, which is a concrete and time-sensitive entitlement available to a defined user population.
The agreement establishes that California residents can request disclosure, deletion, or cessation of sale or sharing of their personal information, and that exercising these rights may not result in discriminatory treatment such as denial of service or pricing differences.
ConductAtlas has identified this type of provision across 294 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.