Creator Data Sharing

What it is

When you subscribe to or comment on a publication on Substack, the creator of that publication receives your name and email address, and that creator then controls how they use your personal information according to their own privacy policies.

Why it matters (compliance & governance perspective)

Your personal data does not stay within Substack's control once you engage with a creator's publication; the creator receives it and handles it under their own terms, which users may not have separately reviewed.

This document changed recently

Consumer impact (what this means for users)

Subscribing to or commenting on any Substack publication transfers your name and email address to the individual creator, who operates under their own privacy practices that may differ significantly from Substack's policy and may not offer equivalent protections.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision is operationally significant under GDPR because it designates creators as separate data controllers, not processors, for the personal data they receive. Under GDPR, this means Substack and the creator may each be independently responsible for their respective data processing activities, and Substack's data protection obligations to EU users may not extend to the creator's downstream processing. The policy explicitly states that creators have their own privacy practices, which means users bear the burden of reviewing those practices independently. GOVERNANCE EXPOSURE: Medium. The practical consequence of creator-as-independent-controller status is that Substack's privacy commitments, including its DPF certification and CCPA compliance, do not extend to the creator's use of subscriber data. This creates a gap in user protection that may not be obvious at the point of subscription. The policy's disclosure that even commenting on an unsubscribed publication results in personal data transfer to the creator is a broader disclosure trigger than many users would anticipate. JURISDICTION FLAGS: EU users should note that creator-controlled data processing falls outside Substack's GDPR responsibilities; the creator becomes an independent controller and the user's GDPR rights must be exercised directly against the creator. This may be practically difficult for users who do not know the legal identity of the creator entity. CONTRACT AND VENDOR IMPLICATIONS: Enterprise or institutional subscribers using Substack publications in professional contexts should review whether creator data handling practices meet their own internal data governance requirements. The absence of standardized creator privacy terms creates variable risk across the platform. COMPLIANCE CONSIDERATIONS: Legal teams advising EU users should flag that GDPR rights regarding creator-held subscriber data must be exercised against the creator, not Substack. Substack may wish to consider whether a minimum privacy standard for creators would reduce platform-level regulatory exposure, though the current policy does not establish such a standard.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Direct Messages Not End-to-End Encrypted high
• Staff Access to Direct Message Contents medium
• Generative AI Service Provider Data Sharing medium
• Account Identifier Sharing with Child Safety Consortia low
• EU-U.S. Data Privacy Framework Compliance and Binding Arbitration low
• Privacy Rights and One-Month Response Commitment low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.