EA keeps your data for as long as it needs to provide services, and can keep it longer for legal or business reasons, with no specific time limits stated. Anonymized data may be kept and used indefinitely.
This analysis describes what EA's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This retention policy establishes EA's operational authority to maintain user data across extended timeframes beyond active service delivery and permits the company to process retained data into de-identified or aggregated forms for internal business operations and permissible external sharing.
Interpretive note: The practical scope of 'legal, operational, or other legitimate reasons' for extended retention is not defined, creating uncertainty about whether EA's actual retention practices align with GDPR storage limitation principles.
EA does not commit to specific data retention timelines, meaning personal data including gameplay history, communications, and account information could be retained indefinitely as long as EA identifies a legitimate reason. Consumers can request data deletion through EA's privacy request process, but EA may decline where retention is claimed as legally or operationally necessary.
How other platforms handle this
We retain personal data for as long as needed to provide our services, comply with our legal obligations, resolve disputes, and enforce our policies. Retention periods will vary depending on the type of data and the purposes for which we use it.
Microsoft retains personal data for as long as necessary to provide the products and fulfill the transactions you have requested, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for differen...
We keep information as long as we need it to provide our products and services and fulfil the purposes described in this policy. This is a case-by-case determination that depends on things like the nature of the information, why it is collected and processed, relevant legal or operational retention ...
Monitoring
EA has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"Retention. We retain the information we collect for as long as necessary to provide our Services, and we may retain that information beyond that period if necessary for legal, operational, or other legitimate reasons. Where possible, we may also de-identify, anonymize, or aggregate the information we collect, or collect it in a way that does not directly identify you. We may use and share such information as necessary for our business purposes and as permitted by applicable law.— Excerpt from EA's EA Privacy and Cookie Policy
REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires personal data to be kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the data is processed (storage limitation principle). The policy's language of 'as long as necessary... and beyond that period if necessary for legal, operational, or other legitimate reasons' is intentionally flexible but may not satisfy GDPR's requirement for defined retention periods or at minimum documented retention schedules. CCPA and CPRA do not impose explicit retention period requirements but do require disclosure of retention practices, which this policy provides in general terms. GOVERNANCE EXPOSURE: Medium. The absence of defined retention periods in the public-facing policy is common in the industry but creates GDPR compliance exposure. EU data protection authorities have issued guidance requiring more specific retention information in privacy notices. The 'operational or other legitimate reasons' carve-out is broad and could be interpreted to permit extended retention that undermines data minimization principles. JURISDICTION FLAGS: EU/EEA data protection authorities (particularly the DPC in Ireland, which may have lead authority for EA's EU operations) have issued guidance on retention schedules. UK ICO similarly expects reasonable retention periods to be defined. California users' deletion rights under CPRA may be limited by EA's claimed legal or operational retention necessity. CONTRACT AND VENDOR IMPLICATIONS: Service providers and processors holding EA data must have retention terms consistent with EA's retention policy. If EA's internal retention schedules differ from the public policy language, vendor agreements should reflect actual practices rather than the general policy language. COMPLIANCE CONSIDERATIONS: Legal teams should maintain documented internal data retention schedules that correspond to each data category and processing purpose, and evaluate whether those schedules can be summarized in the public privacy policy in a manner consistent with GDPR transparency requirements. The de-identification and anonymization carve-out should be assessed against GDPR standards for true anonymization, as pseudonymized data remains subject to GDPR.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This retention policy establishes EA's operational authority to maintain user data across extended timeframes beyond active service delivery and permits the company to process retained data into de-identified or aggregated forms for internal business operations and permissible external sharing.
EA does not commit to specific data retention timelines, meaning personal data including gameplay history, communications, and account information could be retained indefinitely as long as EA identifies a legitimate reason. Consumers can request data deletion through EA's privacy request process, but EA may decline where retention is claimed as legally or operationally necessary.
ConductAtlas has identified this type of provision across 65 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by EA.