Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states Medium does not currently sell personal information but reserves the right to do so in the future, and grants California residents the right to opt out of any such future sale, along with rights to know, delete, and non-discrimination under the CCPA.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Medium may engage in personal information sales in the future, with a corresponding opt-out right for California residents. The reservation of the right to sell personal information, while paired with an opt-out, is a material disclosure for users who may not anticipate this potential future practice.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Under this clause, California residents have the right to request information about, and deletion of, their personal data, and to opt out of any future personal information sales if Medium commences that activity. The agreement states that Medium does not currently sell personal information.
Cross-platform context
See how other platforms handle CCPA Rights and Future Data Sale Reservation and similar clauses.
Compare across platforms →Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Medium does not sell your personal information. Subject to certain limitations, you have the right to (1) request to know more about the categories and specific pieces of personal information we collect, use, and disclose about you, (2) request deletion of your personal information, (3) opt out of any sales of your personal information, if we engage in that activity in the future, and (4) not be discriminated against for exercising these rights. You may make these requests by emailing us at privacy@medium.com or by completing this webform.Excerpt from Medium's Privacy Policy
1) REGULATORY LANDSCAPE: This provision is governed by the California Consumer Privacy Act and its amendments under the California Privacy Rights Act. The primary enforcement authority is the California Privacy Protection Agency and the California Attorney General. The provision's forward-looking reservation of the right to sell personal information, combined with a stated opt-out mechanism, is consistent with CCPA requirements, though any future activation of data sales would require updated disclosures and potentially additional consent mechanisms depending on the data categories involved. 2) GOVERNANCE EXPOSURE: Low to Medium. The current state (no sale of personal information) presents minimal exposure. However, any future decision to sell personal information would require material updates to this policy, updated disclosures, and operational implementation of opt-out mechanisms compliant with CCPA timelines and requirements. 3) JURISDICTION FLAGS: This section applies specifically to California residents. Users in other US states with comparable privacy laws (such as Virginia, Colorado, Connecticut, or Texas) may have analogous rights under those frameworks, but the policy does not address those jurisdictions explicitly. 4) CONTRACT AND VENDOR IMPLICATIONS: If Medium were to commence personal information sales, existing data processing agreements and vendor contracts may require review to ensure downstream handling of sold data is appropriately governed. Organizations with employees or clients who are California residents should monitor for any policy update activating data sale provisions. 5) COMPLIANCE CONSIDERATIONS: Legal teams should establish a monitoring process to identify any future Medium policy changes that activate the data sale provision, which would trigger an obligation to evaluate opt-out workflows and update internal data inventories. The policy's verification mechanism for CCPA requests (requiring identifying information for webform submissions) should be assessed for compliance with CCPA's verification requirements.
This provision establishes that Medium may engage in personal information sales in the future, with a corresponding opt-out right for California residents. The reservation of the right to sell personal information, while paired with an opt-out, is a material disclosure for users who may not anticipate this potential future practice.
Under this clause, California residents have the right to request information about, and deletion of, their personal data, and to opt out of any future personal information sales if Medium commences that activity. The agreement states that Medium does not currently sell personal information.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.