The policy states that PayPal retains Personal Information for the duration of the user relationship plus 10 years after the relationship ends, with extensions permitted for litigation, legal compliance, and other specified purposes. Biometric data is subject to a separate stated maximum of 3 years after account closure.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a 10-year default post-relationship retention period for Personal Information, which may interact with GDPR's data minimization and storage limitation principles, as well as state privacy law requirements. The policy also states that biometric data is retained for no more than 3 years after account closure unless required by applicable law, establishing a distinct retention framework for that data category.
⚠ Personal Information will be retained for the duration of the relationship plus 10 years as stated, subject to the exceptions specified in the policy
Cross-platform context
See how other platforms handle Data Retention: 10-Year Post-Relationship Period and similar clauses.
Compare across platforms →"We retain Personal Information for as long as needed or is permitted in context of the purpose for which it was collected and consistent with applicable law. The criteria used to determine our retention period is as follows: Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end, unless we need to keep it longer to the extent permitted by applicable law.Excerpt from PayPal's Privacy Statement
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a 10-year default post-relationship retention period for Personal Information, which may interact with GDPR's data minimization and storage limitation principles, as well as state privacy law requirements. The policy also states that biometric data is retained for no more than 3 years after account closure unless required by applicable law, establishing a distinct retention framework for that …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.