Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes Medium and third-party partners to use cookies, web beacons, and similar technologies to collect usage information and deliver targeted advertising, and permits third parties to independently collect information about user online activities through these technologies on Medium's platform.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that third-party tracking for targeted advertising is permitted on Medium's platform, which engages GDPR consent requirements under the ePrivacy Directive and CCPA opt-out obligations for cross-context behavioral advertising under CPRA.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Removal of the explicit cookies and tracking technologies provision eliminates clear disclosure about first-party and third-party tracking for advertising and analytics purposes, potentially reducing transparency about surveillance mechanisms.
View full change record →Expanded to explicitly mention third-party partners' use of tracking technologies, web beacons, targeted advertising, and third-party data collection; removed reference to Cookie Policy.
View full change record →Under this clause, third-party partners may place tracking technologies on users' devices to collect browsing and activity data for targeted advertising; users in the EU must be provided with consent mechanisms, and California residents may opt out of this sharing as defined under CPRA.
How other platforms handle this
If your browser sends a Do Not Track (DNT) signal, GitHub will not set non-essential cookies and will not load third party resources which set non-essential cookies.
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We and our third-party partners may use cookies, web beacons, and similar tracking technologies to collect information about your use of our Services and to deliver targeted advertising to you. We also allow third parties to collect information about your online activities through cookies and other tracking technologies.Excerpt from Medium's Privacy Policy
1. REGULATORY LANDSCAPE: The EU ePrivacy Directive requires informed consent prior to placing non-essential cookies on user devices, implemented through national laws across EU member states. GDPR Article 6 applies to personal data collected through tracking technologies. CCPA/CPRA treats cross-context behavioral advertising as 'sharing' requiring an opt-out mechanism. The FTC has authority over deceptive tracking practices for US users. 2. GOVERNANCE EXPOSURE: Medium. The policy's authorization of third-party data collection through cookies for targeted advertising creates joint liability considerations under GDPR, as established in CJEU case law regarding website operators' responsibility for third-party cookies (Planet49 judgment). Medium's cookie consent mechanism must satisfy EU ePrivacy and GDPR consent standards. 3. JURISDICTION FLAGS: EU and EEA users have heightened exposure due to ePrivacy Directive and GDPR consent requirements. California users' cross-context behavioral advertising opt-out obligations engage CPRA. Illinois BIPA does not directly apply unless biometric data is collected through tracking technologies. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations embedding Medium content or using Medium APIs should assess whether Medium's third-party cookie practices create compliance obligations on their own properties under applicable cookie consent laws. 5. COMPLIANCE CONSIDERATIONS: Legal teams should verify that Medium's cookie consent management platform (CMP) meets the technical and operational standards required by EU supervisory authorities, including granular consent per cookie category. CPRA compliance requires that the opt-out of sharing for behavioral advertising be honored for California users' cookie-based data.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that third-party tracking for targeted advertising is permitted on Medium's platform, which engages GDPR consent requirements under the ePrivacy Directive and CCPA opt-out obligations for cross-context behavioral advertising under CPRA.
Under this clause, third-party partners may place tracking technologies on users' devices to collect browsing and activity data for targeted advertising; users in the EU must be provided with consent mechanisms, and California residents may opt out of this sharing as defined under CPRA.
ConductAtlas has identified this type of provision across 294 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.