The policy articulates four GDPR lawful bases for processing: contractual necessity, legitimate interests, legal obligation, and consent, with withdrawal of consent available at any time where consent is the stated basis.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal framework under which Medium processes personal data for EEA, UK, and Swiss users, and defines the conditions under which users may withdraw consent or object to processing. The reliance on legitimate interests for analytics, product improvement, and data analytics is operationally significant because it does not require prior consent from users.
Interpretive note: The adequacy of Medium's Legitimate Interests Assessments for analytics and ML training is not disclosed in the policy, leaving the sufficiency of that lawful basis uncertain without supplementary documentation.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →Provision removes EEA-specific language and restructures the lawful bases explanation with specific examples; notably adds 'conduct data analytics' as an explicit legitimate interest example.
View full change record →Under this clause, EEA, UK, and Swiss users have the right to access, correct, erase, and port their personal data, and to object to or restrict processing in certain circumstances. The policy states that consent-based processing may be withdrawn at any time by deleting the account.
Cross-platform context
See how other platforms handle GDPR Lawful Basis and Data Subject Rights and similar clauses.
Compare across platforms →"When we process your personal data, we will do so in reliance on the following lawful bases: To perform our responsibilities under our contract with you (e.g., providing the products and services you requested). When we have a legitimate interest in processing your personal data to operate our business or protect our interests (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you). To comply with our legal obligations (e.g., to maintain a record of your consents and track those who have opted out of non-administrative communications). When we have your consent to do so (e.g., when you opt in to receive non-administrative communications from us). When consent is the legal basis for our processing your personal data, you may withdraw such consent at any time.Excerpt from Medium's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages the GDPR, the UK data protection framework, and the Swiss Federal Act on Data Protection.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the legal framework under which Medium processes personal data for EEA, UK, and Swiss users, and defines the conditions under which users may withdraw consent or object to processing. The reliance on legitimate interests for analytics, product improvement, and data analytics is operationally significant because it does not require prior consent from users.
Under this clause, EEA, UK, and Swiss users have the right to access, correct, erase, and port their personal data, and to object to or restrict processing in certain circumstances. The policy states that consent-based processing may be withdrawn at any time by deleting the account.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.