This analysis describes what Indeed's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Retention is governed by three independent triggers — purpose fulfillment, legal requirements, or user deletion request — meaning data may persist until all applicable conditions are addressed.
Interpretive note: The clause establishes three independent grounds for retention; the canonical claim states the primary structure. All three grounds are noted in omitted_material.
The updated terms authorize Indeed to process personal data for a broader range of purposes, including fraud, abuse, platform-security threats, and risks to users or the public. The policy now explicitly states that Indeed may share information with law enforcement, regulators, and government authorities where lawful and appropriate, including in cases where sharing is voluntary rather than in response to compulsory legal process. For job seekers, device information is now included when applications are transferred to employers' systems, such as applicant tracking systems or scheduling platforms.
View change record →The updated policy explicitly includes phone number as a type of device information that Indeed collects. Previously, the policy described device information as limited to IP address, device ID, and user agent. Additionally, the policy now states that Indeed relies on legitimate interests not only for keeping sites safe and secure, but also for 'improving our Sites and services', which broadens the stated basis for processing personal data. These changes formalize expanded data collection categories and processing justifications under the same legal framework.
View change record →Users can request deletion of their personal data, but data may also be retained as long as its purpose is unfulfilled or as required by law, regardless of a deletion request.
How other platforms handle this
We retain Personal Data that you provide to us where we have an ongoing legitimate business need to do so... When we have no ongoing legitimate business need to process your Personal Data, we securely delete the information or anonymize it...
Starbucks stores information as reasonably necessary and proportionate to accomplish the purposes identified in this Notice based on criteria such as the length of time we need to provide the services to you, and to meet legal requirements...
search engines and other third-parties may still retain copies of your public information, such as any posts and comments you made in the Webull Community, even after you have deleted the information from the Services...
"Where Indeed acts as a controller of your Personal Data, we retain such data until it is no longer necessary to fulfill the purpose it is being used for, as required by applicable laws, or until you ask us to delete it.Excerpt from Indeed's Privacy Policy
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Retention is governed by three independent triggers — purpose fulfillment, legal requirements, or user deletion request — meaning data may persist until all applicable conditions are addressed.
Users can request deletion of their personal data, but data may also be retained as long as its purpose is unfulfilled or as required by law, regardless of a deletion request.
ConductAtlas has identified this type of provision across 275 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Indeed.