Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Users consent to Medium processing, transferring, and storing their personal information in the United States and other countries, which may not provide equivalent data protection rights to those available under the user's local law.
This analysis describes what Medium's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes international transfer and storage of user data without specifying the transfer mechanisms or safeguards in place, and expressly acknowledges that users may have fewer protections in destination countries than under their local law. The adequacy of this disclosure for GDPR compliance purposes may require evaluation under applicable regulatory guidance.
Interpretive note: The provision does not specify transfer mechanisms, recipient countries, or safeguards; GDPR compliance implications depend on what is disclosed in the separately referenced Privacy Policy and the transfer mechanisms Medium relies upon.
The updated terms establish that Medium may stop providing the Services or any of its features within its sole discretion. The prior language focused on subscription account sign-up mechanics; the new provision creates an explicit contractual reservation allowing Medium to discontinue platform features or the entire service without conditions tied to a specific event or timeline. The terms do not specify advance notice requirements, transition periods, or user remedies if the service is discontinued.
View change record →The updated terms expand a data collection warranty to apply to all personal information users provide to Medium, not limited to newsletter editor submissions. Users now represent and warrant that any personal information they submit has been lawfully collected and that all required notices and consents were obtained before collection. This means the warranty applies whether data is provided through newsletters, account profiles, submissions, or other Medium features. If a user provides personal information collected without proper notice or consent, they may be in breach of this representation.
View change record →This clause authorizes Medium to process, transfer, and store user information in the US and other countries. The agreement acknowledges that data protection rights may differ in destination countries compared to a user's home jurisdiction.
Cross-platform context
See how other platforms handle International Data Transfer Authorization and similar clauses.
Compare across platforms →Monitoring
Medium has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"In order for us to provide our Services, you agree that we may process, transfer and store information about you in the US and other countries, where you may not have the same rights and protections as you do under local law.Excerpt from Medium's Terms of Service
1) REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V, which requires that transfers of personal data to third countries be based on adequacy decisions, standard contractual clauses, binding corporate rules, or other approved transfer mechanisms. The provision's broad authorization without specifying a transfer mechanism may require evaluation under GDPR requirements and the guidance issued by European Data Protection Authorities following the Schrems II decision. CCPA and UK GDPR may impose additional or parallel requirements on international data transfers for California and UK users respectively. 2) GOVERNANCE EXPOSURE: High for EU and EEA users. The provision does not identify specific transfer mechanisms or recipient countries beyond 'US and other countries,' which is the level of disclosure typically examined in GDPR transfer compliance assessments. A Medium Corporation's Privacy Policy is referenced for additional detail but is not reproduced here. 3) JURISDICTION FLAGS: EU and EEA users have heightened exposure given GDPR Chapter V requirements. UK users are subject to UK GDPR and the International Data Transfer Agreement framework post-Brexit. Switzerland applies the Federal Act on Data Protection. California residents are subject to CCPA but the CCPA does not impose equivalent international transfer restrictions. 4) CONTRACT AND VENDOR IMPLICATIONS: Institutional or enterprise users in regulated sectors (financial services, healthcare, legal) should assess whether Medium's international transfer practices are compatible with sector-specific data residency or localization requirements. The terms do not specify subprocessor locations or data residency options. 5) COMPLIANCE CONSIDERATIONS: EU and UK compliance teams should assess whether Medium's Privacy Policy (referenced but not reproduced here) specifies the transfer mechanisms relied upon and whether those mechanisms are current following post-Schrems II regulatory guidance. Data mapping exercises should identify what categories of personal data are transferred and to which jurisdictions. Where adequate transfer mechanisms cannot be confirmed, organizations should assess whether Medium usage is consistent with their data transfer obligations.
This provision authorizes international transfer and storage of user data without specifying the transfer mechanisms or safeguards in place, and expressly acknowledges that users may have fewer protections in destination countries than under their local law. The adequacy of this disclosure for GDPR compliance purposes may require evaluation under applicable regulatory guidance.
This clause authorizes Medium to process, transfer, and store user information in the US and other countries. The agreement acknowledges that data protection rights may differ in destination countries compared to a user's home jurisdiction.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Medium.