Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that personal information may be transferred to and stored in jurisdictions outside the user's home country, including via Amazon Web Services data centers globally, and states that Medium will take steps to ensure adequate protection without specifying the legal transfer mechanisms used.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that international data transfers occur to jurisdictions that may not provide equivalent data protection to the user's home jurisdiction. The policy does not name the specific legal mechanisms used to safeguard these transfers, such as Standard Contractual Clauses, which is a detail that GDPR Chapter V compliance reviews typically require.
Interpretive note: The policy does not specify which legal transfer mechanisms are used, so the degree of compliance with GDPR Chapter V and equivalent frameworks cannot be confirmed from the document alone.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Under this clause, personal information submitted by users in the EEA, UK, Switzerland, or other jurisdictions may be stored or processed in the United States or other countries with potentially different data protection standards. The document states that steps will be taken to ensure adequate protection but does not specify what those steps are.
Cross-platform context
See how other platforms handle Cross-Border Data Transfer and similar clauses.
Compare across platforms →Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Medium is headquartered in the United States, and we have operations and service providers in the United States and other countries. Therefore, we and our service providers may transfer your personal information to, or store or access it in, jurisdictions that may not provide levels of data protection that are equivalent to those of your home jurisdiction. For example, we transfer personal data to Amazon Web Services, one of our service providers that processes personal information for us in various data center locations across the globe, including those listed here. We will take steps to ensure that your personal information receives an adequate level of protection in the jurisdictions in which we process it.Excerpt from Medium's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Chapter V (transfers of personal data to third countries) for EEA users, the UK data protection framework's equivalent international transfer requirements, and the Swiss Federal Act on Data Protection. The relevant enforcement authorities are the applicable national Data Protection Authorities, the UK ICO, and the Swiss FDPIC. The policy's general assurance of 'adequate protection' without naming specific transfer mechanisms may not satisfy the specificity requirements applicable under these frameworks. 2) GOVERNANCE EXPOSURE: Medium. The absence of named transfer mechanisms (such as Standard Contractual Clauses or adequacy decisions) in the policy text creates potential exposure under GDPR Chapter V and equivalent UK and Swiss frameworks. Following the Schrems II decision by the Court of Justice of the European Union, reliance on transfer mechanisms requires supplementary assessment where data is transferred to the United States, and the policy does not address this. 3) JURISDICTION FLAGS: EEA and UK users face the highest exposure given GDPR and UK GDPR requirements for documented, specific transfer mechanisms. Swiss users are also affected under the revised Swiss Federal Act on Data Protection. California users are less directly affected by this provision as CCPA does not impose equivalent cross-border transfer requirements. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations subject to GDPR that use Medium's platform and submit personal data through it should assess whether Medium's transfer mechanisms are adequately documented and whether their own data processing agreements with Medium address GDPR Chapter V requirements. A vendor assessment may be warranted to confirm whether Standard Contractual Clauses or equivalent instruments are in place. 5) COMPLIANCE CONSIDERATIONS: Legal teams should request supplementary documentation from Medium regarding the specific transfer mechanisms in place for transfers to the United States and other non-adequate jurisdictions. Data mapping updates should reflect the international transfer of user data via AWS. Organizations subject to GDPR should evaluate whether their own Records of Processing Activities accurately capture the onward transfer of data through Medium's services.
This provision establishes that international data transfers occur to jurisdictions that may not provide equivalent data protection to the user's home jurisdiction. The policy does not name the specific legal mechanisms used to safeguard these transfers, such as Standard Contractual Clauses, which is a detail that GDPR Chapter V compliance reviews typically require.
Under this clause, personal information submitted by users in the EEA, UK, Switzerland, or other jurisdictions may be stored or processed in the United States or other countries with potentially different data protection standards. The document states that steps will be taken to ensure adequate protection but does not specify what those steps are.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.