> Embedding Medium posts, profiles and follow buttons on your website under the GDPR and ePrivacy: cookies, consent and US data transfers explained. > > Canonical: https://www.flowconsent.com/en/services/cms/medium CMS # Medium Unclassified Medium is a US publishing platform whose embeds and widgets set cookies for analytics and personalization. Embedding Medium content requires prior consent under the ePrivacy Directive. [Block Medium until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Required - Documented cookies 6 - Third-party domains 5 - Servers United States (A Medium Corporation, San Francisco) Overview ## What does Medium do? ## What Medium Is Medium is an online publishing platform launched in 2012 by Evan Williams, co-founder of Twitter and Blogger. Operated by A Medium Corporation from San Francisco, California, Medium hosts articles written by individual authors and professional publications on a wide range of topics. Readers can browse for free with limits or subscribe to the paid Medium Member program for unlimited access. Authors can earn money through the Medium Partner Program based on reader engagement. Beyond its native website and apps, Medium offers JavaScript embeds that allow third-party websites to display a Medium post, a follow button or a profile widget. These embeds are commonly used by company blogs, portfolios and newsletters that want to surface Medium content without rehosting it. The embedded scripts are served from medium.com and related domains and execute in the visitor's browser as soon as the page loads. ## Data and Cookies Set by Medium Embeds When a Medium embed loads, the visitor's browser establishes a direct connection to Medium servers. Medium can read existing cookies (such as a persistent visitor identifier uid and a session identifier sid) and may write new ones for personalization, preferences (pr), timezone (tz) and cross-site request protection (xsrf). Medium also relies on its internal analytics stack and historically on third-party analytics such as Mixpanel and Google Analytics. In addition to cookies, Medium automatically receives the page URL where the embed appears, the visitor IP address, the user agent string and the language/timezone of the browser. When the visitor is logged into a Medium account, these signals can be linked to a known profile and used to refine the recommendation engine on medium.com. From a data protection standpoint this constitutes personal data processing by Medium and creates a joint or independent controller-processor relationship with the website operator. ## GDPR and ePrivacy Implications Because Medium embeds store and read information on the visitor's terminal equipment, Article 5(3) of the ePrivacy Directive (as transposed in national law) requires prior, informed and freely given consent before any non-essential cookie is set. The GDPR adds a layer of obligations: the website operator must identify a lawful basis under Art. 6, perform a balancing test for any legitimate interest claim, inform users in a clear privacy notice and keep a record of processing activities. For embeds that load advertising or profiling cookies, EDPB guidance and consistent case law from the CJEU (Fashion ID, Planet49) treat the website operator and Medium as joint controllers for the collection and transmission phase. The website is responsible for collecting valid consent; Medium is responsible for what it does with the data afterwards. ## International Transfers to the United States A Medium Corporation is established in the United States and processes the data collected through embeds on infrastructure located in the US (AWS and Google Cloud regions). Transfers from the EU/EEA to the US are subject to Chapter V of the GDPR. In practice, controllers must rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR or, where applicable, on a self-certification of Medium under the EU-US Data Privacy Framework. A Transfer Impact Assessment is required to evaluate US surveillance laws (FISA 702, EO 12333) and, when needed, implement supplementary measures. ## Compliance Steps for Embedding Medium Content To embed Medium content lawfully, integrate the embed script through a Consent Management Platform that blocks third-party JavaScript until the visitor opts in to the Statistics or Marketing category. Display a contextual placeholder (a click-to-load card) explaining that loading the content will transfer data to Medium in the United States. Update the cookie notice and privacy policy to list the cookies, the categories of recipients, the retention periods and the transfer mechanism. Keep a written assessment of joint controllership where the embed includes the follow button or other profiling elements. Lower-impact alternatives include republishing the article on your own site under a canonical link, using Medium's RSS feed to render static excerpts, or hosting your blog on a self-managed platform such as Ghost or WordPress when the editorial workflow allows it. Compliance ## Medium and the GDPR Medium is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) for embeds with cookies and for advertising and recommendation profiling - Risk level medium - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA ### Impact assessment (DPIA) A DPIA is recommended when Medium embeds are used at scale or combined with other tracking. Assess data minimisation, the risk of cross-site tracking, profiling for recommendations and the international transfer to the United States. Document mitigation measures such as conditional loading after consent and the use of Standard Contractual Clauses with a Transfer Impact Assessment. ### Sample text for your banner > This page contains content embedded from Medium (A Medium Corporation, USA). Loading these embeds places cookies on your device used for analytics, personalization and recommendations, and transfers your IP address and browsing data to the United States. Do you accept the loading of Medium content? Cookies and trackers ## What Medium sets and contacts - Tracking method JavaScript embed (post embed, follow button, profile widget) and analytics cookies - Server location United States (A Medium Corporation, San Francisco) - Data transferred outside the EU Medium processes data on infrastructure in the United States. International transfers are governed by Standard Contractual Clauses under Art. 46(2)(c) GDPR and require a Transfer Impact Assessment. ### Cookies set (6) | Name | Type | Duration | Purpose | | ---- | ---------- | -------- | --------------------------------------------------------------------------------------------------------------------------------- | | uid | tracking | 1 year | Persistent visitor identifier used by Medium to recognise returning readers across sessions and to feed the recommendation engine | | sid | functional | Session | Session identifier maintaining the visitor state while interacting with Medium embeds and pages | | \_ga | analytics | 2 years | Google Analytics client identifier set when Medium loads its analytics stack; used to distinguish unique visitors | | pr | functional | 6 months | Stores reader preferences such as content density and display options on the Medium interface | | tz | functional | 6 months | Stores the visitor timezone to display localised dates and times for articles and notifications | | xsrf | security | Session | Cross-site request forgery token protecting authenticated actions performed against Medium services | ### Third-party domains contacted (5) - `medium.com` - `*.medium.com` - `cdn-images-1.medium.com` - `miro.medium.com` - `medium.statuspage.io` Questions ## Frequently asked questions about Medium Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does a Medium embed set on my visitors devices? A typical Medium embed can store or read several cookies including uid (persistent visitor identifier used to recognise returning readers), sid (session identifier), pr (preferences), tz (timezone) and xsrf (cross-site request forgery protection). Depending on the configuration, analytics cookies such as \_ga (Google Analytics) and Mixpanel identifiers may also be set. None of these are strictly necessary for the website operator and therefore require consent. ### Do I need user consent before loading a Medium embed? Yes. Because the embed reads and writes information on the visitors device for purposes that are not strictly necessary, Article 5(3) of the ePrivacy Directive requires prior, informed and freely given consent. The embed script and any associated cookies must remain blocked until the visitor opts in through a compliant Consent Management Platform. ### What is the appropriate legal basis under GDPR? For non-essential cookies, ePrivacy already mandates consent and consent (Art. 6(1)(a) GDPR) is the most appropriate basis for the subsequent processing. Legitimate interest (Art. 6(1)(f) GDPR) is generally not available where profiling cookies are involved because the balancing test rarely favours the controller in light of the visitor s expectations. ### Are visitor data transferred to the United States? Yes. A Medium Corporation is headquartered in San Francisco and processes the data on US-based infrastructure (AWS, Google Cloud). Transfers from the EU/EEA rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR and, where applicable, on a self-certification under the EU-US Data Privacy Framework. A documented Transfer Impact Assessment is required. ### Do I need to carry out a Data Protection Impact Assessment? A DPIA is not automatic but is strongly recommended when Medium embeds are widely deployed, when they are combined with other tracking technologies or when they appear on pages targeting children or vulnerable audiences. The DPIA must address profiling, the international transfer and the rights of data subjects. ### How do I implement Medium embeds in a compliant way? Wrap the Medium embed code in a script type "text/plain" or use the data-attribute pattern recognised by your CMP. Display a contextual placeholder explaining the data transfer and giving access to a granular consent choice. Activate the script only after the visitor opts into the relevant category. Document the implementation in your records of processing activities. ### What are the alternatives to embedding Medium? You can republish the article on your own website with a canonical link pointing back to Medium, use Medium s RSS feed to render static excerpts on the server side, or move to a self-hosted publishing platform. Substack, Ghost, Hashnode, Dev.to, WordPress and LinkedIn Articles are the most common alternatives, each with their own compliance trade-offs. ### Must Medium be listed in my cookie policy and privacy notice? Yes. Your cookie notice should list the Medium cookies with their name, purpose and retention, and your privacy policy should identify Medium as a recipient of personal data, describe the purpose of the processing, mention the transfer to the United States and the safeguards in place, and explain how visitors can exercise their GDPR rights. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Webflow CDN](https://www.flowconsent.com/en/services/cms/webflow-cdn) [Webflow CDN is a content delivery network (CDN) that accelerates website performance by distributing content across a global network of edge servers. It reduces latency, improves page load times, and handles traffic spikes by serving cached content from the nearest location. Webflow CDN supports static and dynamic content acceleration, DDoS protection, and SSL/TLS encryption. With real-time analytics and purge capabilities, Webflow CDN ensures fast, reliable delivery.](https://www.flowconsent.com/en/services/cms/webflow-cdn) [CMS](https://www.flowconsent.com/en/services/cms/webflow-cdn) · ### [Gallery](https://www.flowconsent.com/en/services/cms/gallery) [Gallery is an image management and optimization solution that helps websites deliver high-quality visual content with optimal performance. It provides automatic compression, format conversion, and responsive delivery for fast page loads. Gallery supports lazy loading, CDN distribution, and gallery creation, enabling businesses to showcase visuals beautifully while maintaining excellent Core Web Vitals scores and search engine rankings.](https://www.flowconsent.com/en/services/cms/gallery) [CMS](https://www.flowconsent.com/en/services/cms/gallery) · ### [Cratejoy](https://www.flowconsent.com/en/services/cms/cratejoy) [Cratejoy is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Cratejoy integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Cratejoy helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/cratejoy) [CMS](https://www.flowconsent.com/en/services/cms/cratejoy) · ### [AMP for WordPress](https://www.flowconsent.com/en/services/cms/amp-for-wordpress) [AMP for WordPress is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. AMP for WordPress supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, AMP for WordPress remains a leading web development choice.](https://www.flowconsent.com/en/services/cms/amp-for-wordpress) [CMS](https://www.flowconsent.com/en/services/cms/amp-for-wordpress) · ### [Noodle Factory](https://www.flowconsent.com/en/services/cms/noodle-factory) [Noodle Factory is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Noodle Factory integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Noodle Factory makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/cms/noodle-factory) [CMS](https://www.flowconsent.com/en/services/cms/noodle-factory) · ### [Cryout Creations Bravada](https://www.flowconsent.com/en/services/cms/cryout-creations-bravada) [Cryout Creations Bravada is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Cryout Creations Bravada supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Cryout Creations Bravada remains a leading web.](https://www.flowconsent.com/en/services/cms/cryout-creations-bravada) [CMS](https://www.flowconsent.com/en/services/cms/cryout-creations-bravada) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)