Substack uses cookies to track your use of its website, and if another user syncs their contacts, your email address or phone number may be collected and stored as an encrypted value.
This analysis describes what Substack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Even if you have never created a Substack account, your contact details could be collected and stored if someone who has your contact information syncs their phone or address book with Substack's app.
Interpretive note: The full cookies section is referenced but not reproduced in the provided document text, meaning the complete scope of tracking practices cannot be fully assessed from this provision alone.
Substack now discloses that it shares account identifiers, such as email addresses and usernames, with trusted industry child safety organizations to detect and prevent online child sexual exploitation and abuse. The policy also establishes that Substack will respond to privacy rights requests within one month, or up to three months for complex requests, providing more certainty about response timelines. Additionally, the policy clarifies that direct message recipients may retain messages even if you request deletion or delete your account, which is now explicitly stated rather than implied.
View change record →The updated policy no longer commits to responding to privacy rights requests within one month or within three months for complex requests. This removes a procedural timeline that previously bound Substack's response obligations. Additionally, the explicit disclosure that Substack shares account identifiers with child safety consortia to detect online child sexual exploitation has been removed from the policy, though the practice itself is not stated to have ended. The direct message retention language is now framed more directly: recipients may retain messages even if you request deletion or close your account.
View change record →The cookie and tracking disclosure language was removed from the contact syncing provision, potentially obscuring tracking practices from users who only review the address book section.
View full change record →Non-users' email addresses and phone numbers may be collected without their direct interaction with Substack if an existing user syncs their address book, a practice with implications for individuals who have not consented to Substack data collection.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
"We may also collect information about you when one of our users syncs their address book information with our app for contact syncing purposes. This information collection is strictly limited to email addresses and phone numbers, and any information collected in this manner is securely stored only as hashed values. Finally, we also collect information on the use of our website via Cookies. Please view the section "Cookies" below for more information.Excerpt from Substack's Privacy Policy
REGULATORY LANDSCAPE: The collection of non-user contact information through address book syncing engages GDPR and ePrivacy Directive obligations, as the individuals whose data is collected have not directly consented to Substack processing their personal data.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Even if you have never created a Substack account, your contact details could be collected and stored if someone who has your contact information syncs their phone or address book with Substack's app.
Non-users' email addresses and phone numbers may be collected without their direct interaction with Substack if an existing user syncs their address book, a practice with implications for individuals who have not consented to Substack data collection.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Substack.