This analysis describes what Substack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The clause establishes that data collection and processing is triggered broadly by any interaction or subscription, covering both free and paid services.
The updated policy discloses that Substack obtains additional information from third parties and sources beyond what it directly collects from you on the platform. This third-party information is combined with platform data to provide what Substack describes as more relevant and safer experiences, and to improve platform analytics. The policy also clarifies that Substack shares account identifiers with child safety industry consortia and receives information from them to detect CSAM. You can review Substack's full privacy policy to understand which third parties may be sources of this information and how your data may be combined with external sources.
View change record →The updated policy discloses that Substack shares account identifiers (email addresses and usernames) with trusted child safety organizations to detect and prevent online child sexual exploitation and abuse. Users now have the right to object to processing of their personal information for personalization purposes on grounds relating to their particular situation, and Substack commits to responding to privacy rights requests within one month. The policy also clarifies that while recipients of direct messages may retain them independently, the platform may restrict your access to messages when other users delete or block you. You can exercise your right to object to personalization processing by contacting privacy@substackinc.com.
View change record →Any interaction with Substack or its services, or any subscription whether paid or unpaid, results in Substack collecting and processing the user's Personal Information.
How other platforms handle this
Depending on the nature of your interaction with us, we collect personal or business information such as name, email address, postal address, and phone number.
When you use our paid Services, including redeeming voucher codes or purchasing paid Services, we collect information related to the payment transaction (with your consent). This may include payment card details (e.g. card account number), billing information, order details, the Services you purchas...
We collect information when you interact with our Services, including the features you use, the links you click on, and your interactions with others on the Services.
"We collect and process Personal Information about you when you interact with us and our services, as well as when you subscribe to any of our paid or unpaid services.Excerpt from Substack's Privacy Policy
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
The clause establishes that data collection and processing is triggered broadly by any interaction or subscription, covering both free and paid services.
Any interaction with Substack or its services, or any subscription whether paid or unpaid, results in Substack collecting and processing the user's Personal Information.
ConductAtlas has identified this type of provision across 286 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Substack.