Yet even those sites like Medium that have built their businesses on ads being evil and use a free plus subscription model offer few details on what they do with their users’ data. This raises the question, does the lack of ads mean that Medium does not track its users in any way? Yet, the clarification that the company won’t provide data to third parties for the explicit purpose of “providing or facilitating third-party advertising to you” while not excluding any other kind of data transfer is concerning. For example, receiving free web analytics services from third parties by permitting them to see all of its web traffic and profile its users would be explicitly permitted under Medium’s terms of service and indeed the company does use at least one third party tracking service on its site. In Medium’s case, the company actually clarifies that it “may share your account information with third parties in some circumstances” and offers several examples including “to a service provider or partner who meets our data protection standards” and “academic or non-profit researchers, with aggregation, anonymization, or pseudonomization.” As with Facebook, Medium’s allowance for data transfer to a “service provider or partner” without constraints on what kinds of partners it will transfer data to or what can be done with that data leaves open nearly any imaginable data exchange, including with commercial data brokers. Most US universities permit academic research that is funded by commercial entities, while the Bayh-Dole Act also provides for the commercialization of academic research that is purely federally funded. Specifically, companies can rewrite their terms of service at any moment to remove their privacy protections and there is nothing you can do about it other than to delete your account prior to the change and hope that that allows you to exclude your data. The company’s terms of service permit it to make all of that data available to anyone it pleases so long as it doesn’t sell the data and doesn’t provide it to a company for the stated purpose of advertisement. Medium can also provide the data to any third-party company or academic or non-profit researchers it pleases and researchers could even spin it into a company or provide it back to a company without additional contractual restrictions that Medium would have to impose separately. Has Medium already shared user data and with how many companies or researchers?
In the aftermath of the Cambridge Analytica scandal, Sheryl Sandberg and Mark Zuckerberg both alluded to the notion of a paid subscription version of Facebook in which users could spend a bit of money for the privilege of not being bombarded with obnoxious advertisements. The unacknowledged undertone of this so-called “paid Facebook” was the promise that somehow removing advertisements would also remove the surveillance machine behind them, granting paying users the ultimate luxury: privacy. However, look a bit closer and it is highly unlikely that “ad free” would actually mean “surveillance free.” In reality the surveillance machine would continue on, but hidden in the shadows rather than announcing its presence in plain sight. After all, as Verizon taught us, simply paying a subscription fee and having no ads doesn’t mean that a company won’t make a profit reselling your most intimate and private data on the side to make even more money. Yet even those sites like Medium that have built their businesses on ads being evil and use a free plus subscription model offer few details on what they do with their users’ data.
Medium’s founder Evan Williams famously positioned the platform as the answer to the “the broken system [of] ad-driven media on the internet.” In his view, the ad-supported web is built to the needs of advertisers, favoring content that garners views rather than conveys insights and encourages vapid virality over thoughtful enlightenment. This view is so central to the very existence of Medium that its about page describes the platform in terms of a crossed out list of advertising related terms.
Of course, Medium did offer ads, but subsequently pivoted to a subscription model in which users willing to pay a small monthly fee would get unlimited access to articles and exclusive premium content.
In many ways Medium is a real-life example of precisely the kind of ad-free subscription-supported citizen social content platform that Sandberg and Zuckerberg had alluded to as a possibility for Facebook. This raises the question, does the lack of ads mean that Medium does not track its users in any way?
This raises the question – what does Medium do with all this data? The company takes great pains to state that “Medium won’t transfer information about you to third parties for the purpose of providing or facilitating third-party advertising to you. We won’t sell information about you.” Yet, the clarification that the company won’t provide data to third parties for the explicit purpose of “providing or facilitating third-party advertising to you” while not excluding any other kind of data transfer is concerning. Instead of stating that Medium will not provide your data to third parties for any purpose, the company explicitly states that it will only not share your data for advertising purposes but grants itself the right to provide your data for any other purpose.
This is a critical distinction, as the current terms of service would appear to permit Medium to provide your personal data to data brokers and other for-profit commercial entities so long as Medium does not receive monetary benefit for the transfer by “selling” the data rather than bartering it for something else. For example, receiving free web analytics services from third parties by permitting them to see all of its web traffic and profile its users would be explicitly permitted under Medium’s terms of service and indeed the company does use at least one third party…