Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy articulates four GDPR lawful bases for processing: contractual necessity, legitimate interests, legal obligation, and consent, with withdrawal of consent available at any time where consent is the stated basis.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal framework under which Medium processes personal data for EEA, UK, and Swiss users, and defines the conditions under which users may withdraw consent or object to processing. The reliance on legitimate interests for analytics, product improvement, and data analytics is operationally significant because it does not require prior consent from users.
Interpretive note: The adequacy of Medium's Legitimate Interests Assessments for analytics and ML training is not disclosed in the policy, leaving the sufficiency of that lawful basis uncertain without supplementary documentation.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Under this clause, EEA, UK, and Swiss users have the right to access, correct, erase, and port their personal data, and to object to or restrict processing in certain circumstances. The policy states that consent-based processing may be withdrawn at any time by deleting the account.
Cross-platform context
See how other platforms handle GDPR Lawful Basis and Data Subject Rights and similar clauses.
Compare across platforms →Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"When we process your personal data, we will do so in reliance on the following lawful bases: To perform our responsibilities under our contract with you (e.g., providing the products and services you requested). When we have a legitimate interest in processing your personal data to operate our business or protect our interests (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you). To comply with our legal obligations (e.g., to maintain a record of your consents and track those who have opted out of non-administrative communications). When we have your consent to do so (e.g., when you opt in to receive non-administrative communications from us). When consent is the legal basis for our processing your personal data, you may withdraw such consent at any time.Excerpt from Medium's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages the GDPR, the UK data protection framework, and the Swiss Federal Act on Data Protection. Enforcement authorities include national Data Protection Authorities within the EEA (coordinated through the EDPB), the UK ICO, and the Swiss FDPIC. The reliance on legitimate interests as a lawful basis for data analytics and product improvement may require a documented Legitimate Interests Assessment, and the adequacy of that documentation is not addressed in the policy. 2) GOVERNANCE EXPOSURE: Medium. The use of legitimate interests as a basis for analytics and product improvement, combined with the ML training disclosure, creates potential exposure where data subjects object to this processing under GDPR Article 21. The policy does not address how objections to legitimate interests-based processing are handled operationally. 3) JURISDICTION FLAGS: EEA and UK users have the most direct exposure and the strongest set of enforceable rights under this provision. Swiss users are covered under the revised Swiss Federal Act on Data Protection. The provision does not apply to users outside these jurisdictions. 4) CONTRACT AND VENDOR IMPLICATIONS: Organizations subject to GDPR that use Medium's platform should confirm whether their use of Medium creates any joint controller or processor obligations and whether Medium's stated lawful bases align with their own data protection frameworks. Where Medium processes data on behalf of organizational users (rather than end consumers), additional contractual review may be warranted. 5) COMPLIANCE CONSIDERATIONS: Legal and compliance teams should assess whether Medium's Legitimate Interests Assessments (which are not disclosed in the policy) are available upon request and whether they adequately cover analytics and ML training use cases. Data Subject Access Request workflows should be mapped to Medium's stated procedures (Settings page, privacy@medium.com) to ensure timely response obligations can be met if employees or clients submit requests.
This provision establishes the legal framework under which Medium processes personal data for EEA, UK, and Swiss users, and defines the conditions under which users may withdraw consent or object to processing. The reliance on legitimate interests for analytics, product improvement, and data analytics is operationally significant because it does not require prior consent from users.
Under this clause, EEA, UK, and Swiss users have the right to access, correct, erase, and port their personal data, and to object to or restrict processing in certain circumstances. The policy states that consent-based processing may be withdrawn at any time by deleting the account.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.