Account Identifier Sharing with Child Safety Consortia

What it is

Substack shares user account identifiers including email addresses and usernames with external child safety organizations to help detect and prevent child sexual abuse material online.

Why it matters (compliance & governance perspective)

This practice, newly disclosed in this policy update, means that identifiers associated with your Substack account may be shared with third-party organizations outside of Substack for a defined safety purpose, without individual user consent or notification.

This document changed recently

Consumer impact (what this means for users)

Your Substack email address and username may be shared with child safety industry consortia as a routine operational practice, which most users will not have been individually notified about prior to this policy update.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages GDPR Article 6 and Article 9 considerations where the sharing of account identifiers with third parties is based on legitimate interests or legal obligation rather than consent. Under GDPR, a legitimate interests assessment (LIA) should document that this sharing is necessary, proportionate, and that the legitimate interest in child safety is not overridden by data subject rights. In the US, sharing for CSAM detection purposes may be supported or required under the PROTECT Our Children Act and related federal frameworks, and may engage the National Center for Missing and Exploited Children (NCMEC) reporting ecosystem. The FTC's oversight of data sharing practices is also relevant. GOVERNANCE EXPOSURE: Medium. The purpose is clearly legitimate and socially significant, but the policy does not identify the specific consortia that receive account identifiers, which limits user ability to understand the scope of disclosure and may not satisfy GDPR transparency requirements that recipients or categories of recipients be disclosed with sufficient specificity. JURISDICTION FLAGS: EU and UK users have rights under GDPR to know the identity or categories of recipients of their data. The absence of named consortia may require further specification for GDPR compliance. California residents may have CCPA rights regarding this disclosure. For minor users, additional sensitivity applies under COPPA in the US. CONTRACT AND VENDOR IMPLICATIONS: Compliance teams should ensure that data sharing agreements with named child safety consortia include appropriate data protection provisions, access controls, and purpose limitations. The policy's use of 'trusted' without further specification warrants vendor due diligence documentation. COMPLIANCE CONSIDERATIONS: A documented legitimate interests assessment for this sharing practice should be maintained. The specific consortia involved should be identified internally and assessed for adequate data protection standards. For EU and UK users, the legal basis for onward transfer of identifiers to these third parties under GDPR Chapter V transfer rules should be confirmed.

Applicable agencies

Provision details

Other risks in this policy

• Direct Messages Not End-to-End Encrypted high
• Staff Access to Direct Message Contents medium
• Generative AI Service Provider Data Sharing medium
• EU-U.S. Data Privacy Framework Compliance and Binding Arbitration low
• Creator Data Sharing medium
• Privacy Rights and One-Month Response Commitment low