The policy states that Substack has certified compliance with the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF for transatlantic personal data transfers, and that DPF Principles govern where they conflict with this policy. Dispute resolution for DPF-related complaints is available through TRUSTe at no cost, with binding arbitration available for unresolved residual claims.
This analysis describes what Substack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal mechanism Substack relies on for transferring personal data from the EU, UK, and Switzerland to the US. DPF certification is subject to FTC enforcement, and the policy provides a tiered dispute resolution process for DPF-related complaints, including binding arbitration as a final recourse mechanism.
Substack now discloses that it shares account identifiers, such as email addresses and usernames, with trusted industry child safety organizations to detect and prevent online child sexual exploitation and abuse. The policy also establishes that Substack will respond to privacy rights requests within one month, or up to three months for complex requests, providing more certainty about response timelines. Additionally, the policy clarifies that direct message recipients may retain messages even if you request deletion or delete your account, which is now explicitly stated rather than implied.
View change record →The updated policy no longer commits to responding to privacy rights requests within one month or within three months for complex requests. This removes a procedural timeline that previously bound Substack's response obligations. Additionally, the explicit disclosure that Substack shares account identifiers with child safety consortia to detect online child sexual exploitation has been removed from the policy, though the practice itself is not stated to have ended. The direct message retention language is now framed more directly: recipients may retain messages even if you request deletion or close your account.
View change record →Under this clause, EU, UK, and Swiss users' Personal Information transferred to Substack in the US is governed by DPF Principles, which take precedence over this policy in the event of conflict. The policy provides a specific dispute resolution pathway through TRUSTe and, ultimately, binding arbitration for unresolved DPF-related complaints.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Monitoring
Substack has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Substack complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) (each, a "DPF") as set forth by the U.S. Department of Commerce. Substack has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. ... Our adherence to the DPFs specified above is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.— Excerpt from Substack's Substack Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Chapter V (international data transfers), UK GDPR international transfer requirements, and the EU-U.S. DPF adequacy decision issued by the European Commission. The FTC is the named enforcement authority for Substack's DPF commitments. The validity of the EU-U.S. DPF adequacy decision is subject to ongoing legal and political risk, and organizations relying on DPF-based transfers should monitor its status. 2. GOVERNANCE EXPOSURE: Medium. DPF certification provides a current lawful basis for EU-to-US data transfers, but the mechanism's continued validity depends on the adequacy decision remaining in force. Organizations processing EU employee or customer data through Substack should document DPF reliance in their transfer impact assessments and monitor for changes. 3. JURISDICTION FLAGS: EU/EEA, UK, and Swiss users have direct exposure to this provision. Organizations with Swiss operations should note the separate Swiss-U.S. DPF certification. UK users should note that the UK Extension to the EU-U.S. DPF governs UK data transfers. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Substack as a data processor for EU personal data should verify that Substack's DPF certification covers the relevant data categories and processing activities. The policy's statement that onward transfers are conducted under agreements providing the same protections as the DPF is relevant for vendor assessment of sub-processor chains. 5. COMPLIANCE CONSIDERATIONS: Legal teams should maintain a record of Substack's DPF certification status (verifiable at dataprivacyframework.gov) and include monitoring of adequacy decision validity in their data transfer compliance programs. If the EU-U.S. DPF adequacy decision is invalidated, alternative transfer mechanisms such as Standard Contractual Clauses may need to be implemented.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the legal mechanism Substack relies on for transferring personal data from the EU, UK, and Switzerland to the US. DPF certification is subject to FTC enforcement, and the policy provides a tiered dispute resolution process for DPF-related complaints, including binding arbitration as a final recourse mechanism.
Under this clause, EU, UK, and Swiss users' Personal Information transferred to Substack in the US is governed by DPF Principles, which take precedence over this policy in the event of conflict. The policy provides a specific dispute resolution pathway through TRUSTe and, ultimately, binding arbitration for unresolved DPF-related complaints.
ConductAtlas has identified this type of provision across 3 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Substack.