Riot keeps your data for as long as needed to run its services, meet legal requirements, or resolve disputes, but does not commit to specific timeframes for most data categories.
This analysis describes what Riot Games's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision defines the operational scope and duration of data storage across Riot Games' systems. By establishing retention periods tied to service delivery and legal compliance rather than fixed timeframes, the clause creates a framework where data persistence depends on ongoing service relationship and regulatory requirements.
Interpretive note: The notice does not provide category-specific retention periods, making it difficult to assess whether specific retention practices comply with GDPR's storage limitation principle; the actual schedules may exist internally but are not disclosed in the policy.
Riot Games has restructured how it presents information about data collection and use in its privacy notice. The company narrowed its third-party disclaimer by removing the phrase 'we don't own or control,' replacing it with 'we don't control'—a distinction that may affect which entities the company is claiming it has no privacy responsibility for. For California residents, the notice now consolidates information about categories of personal information and their purposes into a single section rather than splitting them across the document. The practical implication depends on how Riot Games operationally interprets 'control' in relation to its business relationships and how California regulators view this language under CCPA notice requirements.
View change record →Riot does not specify fixed retention periods for most data categories, meaning your personal data including gameplay records, communications content, and behavioral profiles may be retained for an extended and not clearly defined period. Submitting a deletion request through the privacy portal is the most direct way to request earlier deletion.
How other platforms handle this
We store information until it is no longer necessary to provide our services and WhatsApp Products, or until your account is deleted or becomes inactive, whichever comes first. This is a case-by-case determination that depends on things like the nature of the information, why it is collected and pro...
You may request deletion of your account at any time. When you request account deletion, we will delete or anonymize your personal information unless we are required to retain it by law, or unless we need to retain it for legitimate business purposes such as resolving disputes, enforcing our agreeme...
We'll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data will depend on a number of...
Monitoring
Riot Games has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We retain your personal data for as long as necessary to provide our Services, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period for each category of data will depend on the purpose for which it was collected and applicable legal requirements. When we no longer need your personal data, we will take steps to delete or anonymize it.— Excerpt from Riot Games's Riot Games Privacy Notice
REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary for the purposes for which the data is processed (storage limitation principle). Retention schedules must be documented under Article 30 records of processing activities. CCPA does not impose explicit retention limits but requires disclosure of retention periods in the privacy notice if reasonably practicable. The notice's lack of specific retention periods for individual data categories may not fully satisfy GDPR's storage limitation requirement. GOVERNANCE EXPOSURE: Medium. The open-ended retention formulation is common across the industry but creates GDPR compliance risk if not backed by documented category-specific retention schedules. The reference to 'resolve disputes' as a retention basis could be used to justify extended retention in practice, particularly for account or transaction records. JURISDICTION FLAGS: EU/EEA users have the strongest interest in assessing whether retention practices comply with GDPR storage limitation. California's CCPA requires disclosure of the period for which personal information will be retained, or if that is not possible, the criteria used to determine that period. The current formulation may not fully satisfy this California disclosure requirement. CONTRACT AND VENDOR IMPLICATIONS: Data processor agreements with service providers should include retention obligations consistent with Riot's stated policy. Sub-processors should be contractually required to delete data upon termination of their service relationship. COMPLIANCE CONSIDERATIONS: A documented data retention schedule specifying category-specific retention periods should be developed and reviewed against the policy. Where retention is based on legal obligation, the specific legal basis for each period should be identified. Automated deletion or anonymization mechanisms should be verified to confirm they operate as stated.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The provision defines the operational scope and duration of data storage across Riot Games' systems. By establishing retention periods tied to service delivery and legal compliance rather than fixed timeframes, the clause creates a framework where data persistence depends on ongoing service relationship and regulatory requirements.
Riot does not specify fixed retention periods for most data categories, meaning your personal data including gameplay records, communications content, and behavioral profiles may be retained for an extended and not clearly defined period. Submitting a deletion request through the privacy portal is the most direct way to request earlier deletion.
ConductAtlas has identified this type of provision across 115 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Riot Games.