Does Substack have a privacy problem?

An alarming email

I got an email yesterday from a well-known writer. They said they’d had a notification through their own email that I had followed them on Substack (you’ll know the sort: “X followed you on Substack”, with a button to follow back), and wanted to let me know that they weren’t on the platform. It was probably, he suggested, someone with the same name or one of those impersonators who show up on social media if you have a sufficiently big profile.

  Which, yes, absolutely plausible. And, as I said to him, I tended from time to time to blithely blip names of friends or writers I like when they turned up in the “suggested follow” section on the app, so if I’d seen him suggested I’d absolutely have hit the orange button. (I’m not naming him here out of respect for his privacy, but he’s a household name with whom I’ve had friendly professional dealings over the years.)

  But here’s the question: why, if I clicked to follow someone of the same name, should Substack have contacted this writer on their private email – harvested, presumably, from my contacts list – when their own records should show that he has had no interaction with the platform?

  This seems to me like a gross breach of data protection and privacy. And there’s no explanation obvious to me as to how it can have happened innocently. The “suggested follows” algorithm, presumably, trawls your contacts for matches with existing Substackers (as well as identifying shared interests so offering the likes of me literary folk who maybe aren’t personal contacts). Maybe it does this loosely (just by name) and maybe it does it precisely (by email address).

  But there’s no way that if the proper guardrails are in place it should match a name and then link it to an email address that it knows is not associated with that or any existing account. And, what’s more, presume to spam this email address unsolicited. My work as a literary editor means I have a number of writers in my contacts list, some of them pretty well known. I make a professional point of keeping their contact details private. If the platform isn’t respecting that principle, I think the platform has a problem.

 I don’t think this just applies to famouses, obviously; if Substack is playing fast and loose with non user data it’s a systemic problem. I only mention this instance because it’s a professional embarrassment and because famouses are even more vulnerable than others to impersonation scams and suchlike.

 Anyone else had this happen? And does Substack Team have an explanation?