Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Medium and its vendors may scan, analyze, and review user content, messages, AI interactions, and associated metadata, including for the purpose of training, testing, and improving machine learning models and algorithms.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that user-generated content and AI interactions, along with associated metadata, may be shared with and analyzed by third-party vendors for ML model training purposes. The scope of 'AI interactions' is not defined in the document, leaving the precise categories of data subject to this processing operationally ambiguous.
Interpretive note: The term 'AI interactions' is not defined in the document, making the precise scope of data subject to scanning and ML training operationally ambiguous.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Under this clause, content submitted or posted by users, messages sent on the platform, and interactions with AI features may be scanned and reviewed by Medium and its vendors, and used to train machine learning models. The agreement does not define 'AI interactions' or specify which metadata categories are included.
Cross-platform context
See how other platforms handle Content and AI Interaction Scanning for ML Model Training and similar clauses.
Compare across platforms →Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We share personal information with vendors, service providers, and consultants that need access to personal information, such as information you submitted or posted through our Service, in order to perform services for us, such as companies that assist us with web hosting, storage, and other infrastructure, analytics, payment processing, fraud prevention and security, customer service, communications, and marketing, and to train, test, and improve technology, including machine learning models and algorithms. We and these vendors, service providers, and consultants may scan, analyze, and review your content, messages, AI interactions, and associated metadata.Excerpt from Medium's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 6 (lawful basis for processing) and potentially Article 22 (automated decision-making) for EEA and UK users, as well as CCPA provisions governing disclosure of data use for business purposes to California residents. The relevant enforcement authorities are the applicable national Data Protection Authorities within the EEA, the UK ICO, and the California Privacy Protection Agency. Where legitimate interests is asserted as the lawful basis for ML training on user content, this may require evaluation under the GDPR balancing test, and the adequacy of that basis has not been confirmed by the document. The EU AI Act may also be relevant to the extent that training activities involve AI systems within its scope, though the document does not address this framework. 2) GOVERNANCE EXPOSURE: Medium. This provision creates compliance exposure primarily around the lawful basis for processing user content for ML training, the adequacy of notice to users about this use, and the definition of 'AI interactions' subject to scanning. The absence of a specific definition for 'AI interactions' creates ambiguity about the scope of data subject to this processing, which may be material in jurisdictions requiring specific and granular disclosure of processing purposes. 3) JURISDICTION FLAGS: EEA and UK users have heightened exposure given GDPR and UK data protection requirements for clear, specific, and documented lawful bases for processing. California residents are affected under CCPA's business purpose disclosure requirements. The provision applies globally to all users, but the enforceability of consent-free ML training on user content may vary by jurisdiction. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations or publishers whose personnel use Medium and submit content through the platform should assess whether this scanning and ML training provision is compatible with their own data protection obligations and any confidentiality requirements applicable to the content submitted. The provision asserts that third-party vendors may also scan and analyze user content, which may trigger vendor assessment obligations under GDPR Article 28 for organizations subject to that framework. 5) COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether Medium's existing privacy notices and consent mechanisms adequately disclose ML training as a processing purpose in a manner sufficient for applicable law in each relevant jurisdiction. A data mapping review to identify which content categories and metadata fields are subject to scanning would be warranted. Organizations subject to GDPR should confirm whether a Data Protection Impact Assessment has been conducted for this processing activity.
This provision establishes that user-generated content and AI interactions, along with associated metadata, may be shared with and analyzed by third-party vendors for ML model training purposes. The scope of 'AI interactions' is not defined in the document, leaving the precise categories of data subject to this processing operationally ambiguous.
Under this clause, content submitted or posted by users, messages sent on the platform, and interactions with AI features may be scanned and reviewed by Medium and its vendors, and used to train machine learning models. The agreement does not define 'AI interactions' or specify which metadata categories are included.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.