Third-Party Data Sharing with Analytics and Advertising Partners

What it is

Medium shares your personal information with outside companies that help it run its business, including companies involved in advertising, analytics, fraud prevention, and payment processing.

Why it matters (compliance & governance perspective)

Your reading habits, account details, and behavioral data may be processed by companies you have not directly interacted with and whose own privacy practices you may not have reviewed.

Consumer impact (what this means for users)

This provision means your reading history, account information, and usage behavior may be shared with third-party analytics and advertising companies, potentially enabling cross-site tracking or targeted advertising based on your Medium activity.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates GDPR Article 28 (processor agreements) and Article 44 (transfers to third countries) where service providers are located outside the EU/EEA. Under CCPA, categories of personal information shared with third parties must be disclosed, and users must be given the ability to opt out of the sale or sharing of personal information. The FTC holds enforcement authority over unfair or deceptive data sharing practices under Section 5 of the FTC Act. GOVERNANCE EXPOSURE: Medium. The policy authorizes broad sharing with service providers and business partners without enumerating specific third parties or their data processing purposes. This level of generality may be insufficient under GDPR transparency requirements and could create audit challenges if a data subject requests a list of recipients under Article 15. JURISDICTION FLAGS: EU/EEA users face heightened exposure given GDPR's requirements for lawful transfer mechanisms and processor agreements. California residents are protected by CCPA's opt-out and disclosure rights. Users in jurisdictions without comprehensive privacy legislation have fewer guaranteed protections under this clause. CONTRACT AND VENDOR IMPLICATIONS: Procurement and vendor management teams should confirm that all third-party service providers processing personal data on Medium's behalf have executed data processing agreements satisfying GDPR Article 28. Organizations using Medium for corporate publishing should assess whether any employee or customer data could flow to these third parties. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the current list of third-party processors and verify DPA coverage. A data mapping exercise should identify which categories of personal data flow to which third parties and for what purpose. The CCPA opt-out mechanism should be tested for accessibility and effectiveness.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• International Data Transfer to the United States medium
• GDPR Rights for EU/EEA Users medium
• CCPA Rights for California Residents medium
• Payment Data Collection and Processing low
• Data Retention Without Fixed Periods medium
• Data Collection from Third-Party Linked Accounts low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.