Substack

What Substack is

Substack is a newsletter and online publishing platform founded in 2017 and headquartered in San Francisco, United States. It enables writers, journalists, podcasters, and creators to publish free and paid newsletters, host podcasts, and share short form posts through the Notes feature. Substack handles email delivery, hosting of publication pages, payment processing through Stripe for paid subscriptions, and audience analytics. Publishers can also embed a subscribe form, a single post embed, or the Notes widget on third party websites, which causes the visitor browser to load scripts and set cookies from substack.com and substackcdn.com.

Data and cookies collected by Substack embeds

When a Substack embed loads on a website, the visitor browser establishes a direct connection with substack.com and substackcdn.com and may receive cookies such as substack.sid and connect.sid for session and authentication, AWSALB for AWS load balancing, and __cf_bm for Cloudflare bot management. Substack also receives the page URL, the IP address, the user agent, and any data the visitor submits in the subscribe form, typically an email address. Newsletter emails sent through Substack include a tracking pixel and rewritten links that record opens and clicks, which constitutes monitoring of subscriber behaviour. These elements together qualify as personal data under Art. 4(1) GDPR.

GDPR and ePrivacy implications

Because Substack embeds write and read cookies that are not strictly necessary to deliver a service explicitly requested by the user, Art. 5(3) of the ePrivacy Directive requires prior informed consent before the embed is loaded. The same logic applies to email tracking pixels, which are addressed by EDPB Guidelines 03/2022 on deceptive design and recital 32 of the ePrivacy Directive. The website operator and Substack act as independent controllers for distinct processing operations, and the operator remains responsible for lawfulness toward visitors under Art. 5 and Art. 26 GDPR. For paid subscriptions, the contractual relationship is between Substack and the subscriber, but the publisher must still inform subscribers about the data flow and the role of Stripe as payment processor.

Consent requirements

Substack subscribe forms, post embeds, and the Notes widget must be blocked by default and only loaded after the visitor gives valid consent through a consent management platform. Consent must be freely given, specific, informed, and unambiguous, and it must be as easy to refuse as to accept. The consent banner should explicitly mention Substack, the categories of data collected, the transfer to the United States, and the retention period. A separate consent or opt in tick box is needed for the actual newsletter signup, in line with Art. 7 GDPR and national implementations of the ePrivacy Directive such as the German TDDDG or the French Data Protection Act.

Transfers to the United States

Substack Inc. is based in California and hosts subscriber data on AWS infrastructure in the United States behind Cloudflare. Personal data of EU and UK residents is therefore transferred outside the European Economic Area. Transfers rely on Standard Contractual Clauses under Art. 46(2)(c) GDPR, and in many cases on the EU US Data Privacy Framework when Substack and its sub processors are certified. Controllers should perform a Transfer Impact Assessment that addresses US surveillance laws such as FISA 702 and Executive Order 12333, document supplementary measures, and keep evidence in the record of processing activities under Art. 30 GDPR.

Compliance steps

To use Substack lawfully on a website targeting EU users, block all Substack embeds before consent, deploy a consent management platform with a granular Substack toggle, and disclose Substack as a recipient and processor in the privacy policy together with the legal basis, retention period, and transfer mechanism. Sign or accept the Substack Data Processing Addendum where applicable, document Standard Contractual Clauses and the Transfer Impact Assessment, and review cookie inventories at least annually. For paid subscriptions, link to the Substack and Stripe privacy notices and ensure that marketing emails respect the right to object and to withdraw consent at any time.