The policy states that Personal Information is retained for the duration of the user relationship plus 10 years after the relationship ends, with extensions permitted for legal obligations, AML compliance, litigation, investigations, and audit purposes.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
A standard 10-year post-relationship retention period is stated for all Personal Information categories, with open-ended extensions for legal and compliance purposes. This retention framework may require evaluation against GDPR's data minimization and storage limitation principles for EEA users, and against state privacy law deletion rights for US users who submit deletion requests after closing their accounts.
⚠ Personal Information will be retained for 10 years after the end of the user relationship, and potentially longer for legal, AML, or litigation purposes, as stated in the policy
Cross-platform context
See how other platforms handle Data Retention: 10-Year Post-Relationship Period and similar clauses.
Compare across platforms →"We retain Personal Information for as long as needed or is permitted in context of the purpose for which it was collected and consistent with applicable law. The criteria used to determine our retention period is as follows: Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end, unless we need to keep it longer to the extent permitted by applicable law, such as: When consistent with a legal obligation to which we are subject, or when permitted under applicable law, such as under applicable bankruptcy laws and AML obligations. In connection with litigation, investigations, audit and compliance practices, or to protect against legal claims.Excerpt from PayPal's Privacy Statement
(1) REGULATORY LANDSCAPE: GDPR Articles 5(1)(e) and 17 impose storage limitation and right to erasure obligations that may constrain open-ended retention periods unless a specific legal basis for continued retention is established.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
A standard 10-year post-relationship retention period is stated for all Personal Information categories, with open-ended extensions for legal and compliance purposes. This retention framework may require evaluation against GDPR's data minimization and storage limitation principles for EEA users, and against state privacy law deletion rights for US users who submit deletion requests after closing their accounts.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.