Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Substack uses cookies to track your use of its website, and if another user syncs their contacts, your email address or phone number may be collected and stored as an encrypted value.
This analysis describes what Substack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Even if you have never created a Substack account, your contact details could be collected and stored if someone who has your contact information syncs their phone or address book with Substack's app.
Interpretive note: The full cookies section is referenced but not reproduced in the provided document text, meaning the complete scope of tracking practices cannot be fully assessed from this provision alone.
Substack now discloses that it shares account identifiers, such as email addresses and usernames, with trusted industry child safety organizations to detect and prevent online child sexual exploitation and abuse. The policy also establishes that Substack will respond to privacy rights requests within one month, or up to three months for complex requests, providing more certainty about response timelines. Additionally, the policy clarifies that direct message recipients may retain messages even if you request deletion or delete your account, which is now explicitly stated rather than implied.
View change record →The updated policy no longer commits to responding to privacy rights requests within one month or within three months for complex requests. This removes a procedural timeline that previously bound Substack's response obligations. Additionally, the explicit disclosure that Substack shares account identifiers with child safety consortia to detect online child sexual exploitation has been removed from the policy, though the practice itself is not stated to have ended. The direct message retention language is now framed more directly: recipients may retain messages even if you request deletion or close your account.
View change record →The cookie and tracking disclosure language was removed from the contact syncing provision, potentially obscuring tracking practices from users who only review the address book section.
View full change record →Non-users' email addresses and phone numbers may be collected without their direct interaction with Substack if an existing user syncs their address book, a practice with implications for individuals who have not consented to Substack data collection.
How other platforms handle this
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
Monitoring
Substack has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We may also collect information about you when one of our users syncs their address book information with our app for contact syncing purposes. This information collection is strictly limited to email addresses and phone numbers, and any information collected in this manner is securely stored only as hashed values. Finally, we also collect information on the use of our website via Cookies. Please view the section "Cookies" below for more information.Excerpt from Substack's Privacy Policy
REGULATORY LANDSCAPE: The collection of non-user contact information through address book syncing engages GDPR and ePrivacy Directive obligations, as the individuals whose data is collected have not directly consented to Substack processing their personal data. Under GDPR, Substack would need a valid legal basis for this processing, and Article 14 requires informing data subjects whose data is obtained from sources other than the data subject themselves. The FTC has taken enforcement action against platforms that collected non-user contact data without adequate disclosure. The ePrivacy Directive's cookie consent requirements are relevant to cookie-based tracking. GOVERNANCE EXPOSURE: Medium. The address book syncing practice affects individuals who are not Substack users and have not agreed to its privacy policy, which creates a third-party data subject exposure. While the policy states data is stored only as hashed values, the collection itself may require a documented legal basis under GDPR. Cookie consent compliance varies by jurisdiction and the adequacy of consent mechanisms should be verified. JURISDICTION FLAGS: EU and UK users and non-users have specific rights under GDPR and the ePrivacy Directive regarding cookie consent and third-party data collection. California non-users whose data is collected through contact syncing may have CCPA rights regarding data collected about them. The Illinois Biometric Information Privacy Act (BIPA) is not directly implicated here as the data is limited to email and phone, but state AG offices in various jurisdictions may scrutinize non-user data collection. CONTRACT AND VENDOR IMPLICATIONS: The policy's reference to the separate Cookies section (which is not fully reproduced in this document) means a complete compliance assessment requires review of that section as well. Cookie audit tools and consent management platform adequacy should be assessed for EU and UK compliance. COMPLIANCE CONSIDERATIONS: A GDPR Article 14 disclosure mechanism for non-user data subjects whose contact information is collected through address book syncing should be evaluated. Cookie consent mechanisms should be audited for compliance with applicable ePrivacy and GDPR requirements. The hashing of contact data should be documented as a privacy-enhancing technical measure.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
Even if you have never created a Substack account, your contact details could be collected and stored if someone who has your contact information syncs their phone or address book with Substack's app.
Non-users' email addresses and phone numbers may be collected without their direct interaction with Substack if an existing user syncs their address book, a practice with implications for individuals who have not consented to Substack data collection.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Substack.