Riot keeps your data for as long as needed to run its services, meet legal requirements, or resolve disputes, but does not commit to specific timeframes for most data categories.
This analysis describes what Riot Games's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Indefinite or open-ended retention tied to broad purposes like 'enforce our agreements' or 'resolve disputes' means data may be retained for longer than users might expect, and specific deletion timelines are not guaranteed.
Interpretive note: The notice does not provide category-specific retention periods, making it difficult to assess whether specific retention practices comply with GDPR's storage limitation principle; the actual schedules may exist internally but are not disclosed in the policy.
Riot Games has restructured how it presents information about data collection and use in its privacy notice. The company narrowed its third-party disclaimer by removing the phrase 'we don't own or control,' replacing it with 'we don't control'—a distinction that may affect which entities the company is claiming it has no privacy responsibility for. For California residents, the notice now consolidates information about categories of personal information and their purposes into a single section rather than splitting them across the document. The practical implication depends on how Riot Games operationally interprets 'control' in relation to its business relationships and how California regulators view this language under CCPA notice requirements.
View change record →Riot does not specify fixed retention periods for most data categories, meaning your personal data including gameplay records, communications content, and behavioral profiles may be retained for an extended and not clearly defined period. Submitting a deletion request through the privacy portal is the most direct way to request earlier deletion.
How other platforms handle this
We retain personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention periods depend on the type of information and the purposes for which it is processed.
We keep information for as long as we need it to provide our products, comply with legal obligations, or for other legitimate purposes, such as to maintain safety, security, and integrity.
After your account is deleted, we keep data about interactions you've had on our service to prevent abuse, ban evaders and others in an effort to protect and ensure the safety and security of our service and our members.
Monitoring
Riot Games has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain your personal data for as long as necessary to provide our Services, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period for each category of data will depend on the purpose for which it was collected and applicable legal requirements. When we no longer need your personal data, we will take steps to delete or anonymize it.— Excerpt from Riot Games's Riot Games Privacy Notice
REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary for the purposes for which the data is processed (storage limitation principle). Retention schedules must be documented under Article 30 records of processing activities. CCPA does not impose explicit retention limits but requires disclosure of retention periods in the privacy notice if reasonably practicable. The notice's lack of specific retention periods for individual data categories may not fully satisfy GDPR's storage limitation requirement. GOVERNANCE EXPOSURE: Medium. The open-ended retention formulation is common across the industry but creates GDPR compliance risk if not backed by documented category-specific retention schedules. The reference to 'resolve disputes' as a retention basis could be used to justify extended retention in practice, particularly for account or transaction records. JURISDICTION FLAGS: EU/EEA users have the strongest interest in assessing whether retention practices comply with GDPR storage limitation. California's CCPA requires disclosure of the period for which personal information will be retained, or if that is not possible, the criteria used to determine that period. The current formulation may not fully satisfy this California disclosure requirement. CONTRACT AND VENDOR IMPLICATIONS: Data processor agreements with service providers should include retention obligations consistent with Riot's stated policy. Sub-processors should be contractually required to delete data upon termination of their service relationship. COMPLIANCE CONSIDERATIONS: A documented data retention schedule specifying category-specific retention periods should be developed and reviewed against the policy. Where retention is based on legal obligation, the specific legal basis for each period should be identified. Automated deletion or anonymization mechanisms should be verified to confirm they operate as stated.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Indefinite or open-ended retention tied to broad purposes like 'enforce our agreements' or 'resolve disputes' means data may be retained for longer than users might expect, and specific deletion timelines are not guaranteed.
Riot does not specify fixed retention periods for most data categories, meaning your personal data including gameplay records, communications content, and behavioral profiles may be retained for an extended and not clearly defined period. Submitting a deletion request through the privacy portal is the most direct way to request earlier deletion.
ConductAtlas has identified this type of provision across 136 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Riot Games.