The policy states that users who opt into the address book feature have their contact names and email addresses converted to encrypted non-reversible identifiers, matched against Medium's member database, with non-member identifiers deleted immediately and all identifiers deleted within 30 days.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision describes a contact matching process that processes personal data of individuals who are not Medium users, relying on legitimate interests as the stated lawful basis. The policy states that non-member identifiers are deleted immediately after matching, and all identifiers within 30 days, which are concrete operational data minimization commitments.
Interpretive note: The adequacy of the legitimate interests basis for processing non-member contact data and the GDPR Article 14 obligations toward those individuals are not addressed in the policy, creating interpretive uncertainty.
The updated policy states that Medium and its vendors may scan, analyze, and review your content, messages, AI interactions, and associated metadata. Data sharing now explicitly includes information you submitted or posted through the service, extending beyond infrastructure support to machine learning model training and improvement. The policy does not indicate an opt-out mechanism or granular user control over this specific use of content.
View change record →This new provision discloses collection and processing of device contact information, justifying it under legitimate interests with references to user rights and company mission, indicating Medium's expanded social discovery features.
View full change record →Under this clause, users who opt into the address book feature authorize Medium to process their device contacts using one-way encryption for the purpose of identifying known Medium members, with deletion of third-party contact identifiers occurring immediately for non-members and within 30 days for all.
Cross-platform context
See how other platforms handle Address Book Contact Processing and similar clauses.
Compare across platforms →"When you use our address book feature, we process contact information from your device to help you discover people you know who are on Medium. Why we do this: We rely on legitimate interests to offer this feature — specifically, our interest in helping you connect with people you know, and our mission to deepen collective understanding through writing, which supports your fundamental right to freedom of expression and information. How it works: When you opt in, we convert contact names and email addresses into encrypted, non-reversible identifiers and match them against our member database. We don't store names or emails in plain text. For contacts who aren't Medium members, we delete their encrypted identifiers immediately after checking. We delete all encrypted identifiers within 30 days.Excerpt from Medium's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 6 (lawful basis for processing third-party contact data) and potentially GDPR Article 14 (information to be provided where personal data has not been obtained from the data …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision describes a contact matching process that processes personal data of individuals who are not Medium users, relying on legitimate interests as the stated lawful basis. The policy states that non-member identifiers are deleted immediately after matching, and all identifiers within 30 days, which are concrete operational data minimization commitments.
Under this clause, users who opt into the address book feature authorize Medium to process their device contacts using one-way encryption for the purpose of identifying known Medium members, with deletion of third-party contact identifiers occurring immediately for non-members and within 30 days for all.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.