Equifax states it keeps your personal information for as long as it needs to for the purposes described in the policy or as required by law, but does not specify fixed retention periods for most data categories.
This analysis describes what Equifax's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Open-ended retention language means Equifax may hold sensitive personal and financial data for extended periods, and consumers have limited visibility into how long specific data types are retained unless they submit access requests.
Interpretive note: The policy's use of open-ended retention language tied to business necessity creates uncertainty about the actual retention period for specific data categories, which varies by purpose and applicable law.
The policy does not commit to specific retention periods for most data categories, which means your biometric, geolocation, and financial profile data may be retained indefinitely as long as Equifax can articulate a business purpose. California residents can submit deletion requests to shorten the effective retention period for their data.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.Excerpt from Equifax's Privacy Policy
REGULATORY LANDSCAPE: CPRA requires that personal information not be retained longer than necessary for the disclosed purpose, and regulators have interpreted this to require that companies establish and document retention schedules.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Open-ended retention language means Equifax may hold sensitive personal and financial data for extended periods, and consumers have limited visibility into how long specific data types are retained unless they submit access requests.
The policy does not commit to specific retention periods for most data categories, which means your biometric, geolocation, and financial profile data may be retained indefinitely as long as Equifax can articulate a business purpose. California residents can submit deletion requests to shorten the effective retention period for their data.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Equifax.