# Medium privacy rating

Hosted publishing platform for articles and blogs, with a paid membership that unlocks member-only stories and pays writers.

## Summary

Medium scores 41 out of 100 (grade D) on the blogging criteria. It meets 3 of 8 criteria: no ads or data sales, tells users about requests and TLS configuration. It partly meets transparency report and security headers. It does not meet open source, no trackers or telemetry and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://medium.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web, Android, iOS
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), Google reCAPTCHA (not scored)
- Category: [Blogging](https://privacyratings.com/blogging/)
- Grade: D (41/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The Android app contains Google Analytics, Google Crashlytics and Facebook Login, and the privacy policy names third-party analytics providers. | https://reports.exodus-privacy.eu.org/en/reports/com.medium.reader/latest/ |
| No ads or data sales | Yes | Member-supported with no ads, and the privacy policy states Medium does not sell personal information. | https://medium.com/membership |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Partial | The privacy policy describes how legal requests are handled, but no request counts are published. | https://policy.medium.com/medium-privacy-policy-f03bf92035c9 |
| Tells users about requests | Yes | The privacy policy promises notice before disclosing data in response to legal process unless prohibited or it would endanger others. | https://policy.medium.com/medium-privacy-policy-f03bf92035c9 |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=medium.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=medium.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/blogging/medium/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/blogging/medium.md