This analysis describes what Substack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The 'at this time' qualifier signals that this human-review requirement is a current practice rather than a permanent policy, leaving open the possibility of future change.
Interpretive note: The phrase 'at this time' is a significant temporal qualifier indicating the practice may not be permanent. This is preserved in all reader-facing fields.
Substack now discloses that it shares account identifiers, such as email addresses and usernames, with trusted industry child safety organizations to detect and prevent online child sexual exploitation and abuse. The policy also establishes that Substack will respond to privacy rights requests within one month, or up to three months for complex requests, providing more certainty about response timelines. Additionally, the policy clarifies that direct message recipients may retain messages even if you request deletion or delete your account, which is now explicitly stated rather than implied.
View change record →The updated policy no longer commits to responding to privacy rights requests within one month or within three months for complex requests. This removes a procedural timeline that previously bound Substack's response obligations. Additionally, the explicit disclosure that Substack shares account identifiers with child safety consortia to detect online child sexual exploitation has been removed from the policy, though the practice itself is not stated to have ended. The direct message retention language is now framed more directly: recipients may retain messages even if you request deletion or close your account.
View change record →Users subject to content moderation actions can currently expect that no final decision will be reached solely through automated means, as human review is required.
How other platforms handle this
Mailchimp uses a combination of automated and human detection review processes to ensure that Members are complying with our Standard Terms of Use and this Acceptable Use Policy.
If you believe automated processing by our Services has resulted in a significant decision affecting you, you may contact us by email at privacy@squarespace.com to request more information and/or request that a human review such decision.
This is still Your Content, and you are responsible for it and its accuracy, as well as your use of it on our Services and any and all decisions made, actions taken, and failures to take action based on Your Content.
"At this time, no final content moderation decisions are made without human review of any automated decisions.Excerpt from Substack's Privacy Policy
How Meta, TikTok, and Supabase restructured governance language across documents, jurisdictions, and consent frameworks through incremental document updates.
How 10 AI platforms describe the use of user data for model training, improvement, and development, based on archived governance provisions.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The 'at this time' qualifier signals that this human-review requirement is a current practice rather than a permanent policy, leaving open the possibility of future change.
Users subject to content moderation actions can currently expect that no final decision will be reached solely through automated means, as human review is required.
ConductAtlas has identified this type of provision across 216 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Substack.