Riot keeps your data for as long as needed to run its services, meet legal requirements, or resolve disputes, but does not commit to specific timeframes for most data categories.
This analysis describes what Riot Games's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Indefinite or open-ended retention tied to broad purposes like 'enforce our agreements' or 'resolve disputes' means data may be retained for longer than users might expect, and specific deletion timelines are not guaranteed.
Interpretive note: The notice does not provide category-specific retention periods, making it difficult to assess whether specific retention practices comply with GDPR's storage limitation principle; the actual schedules may exist internally but are not disclosed in the policy.
Riot Games has restructured how it presents information about data collection and use in its privacy notice. The company narrowed its third-party disclaimer by removing the phrase 'we don't own or control,' replacing it with 'we don't control'—a distinction that may affect which entities the company is claiming it has no privacy responsibility for. For California residents, the notice now consolidates information about categories of personal information and their purposes into a single section rather than splitting them across the document. The practical implication depends on how Riot Games operationally interprets 'control' in relation to its business relationships and how California regulators view this language under CCPA notice requirements.
View change record →Riot does not specify fixed retention periods for most data categories, meaning your personal data including gameplay records, communications content, and behavioral profiles may be retained for an extended and not clearly defined period. Submitting a deletion request through the privacy portal is the most direct way to request earlier deletion.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain your personal data for as long as necessary to provide our Services, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period for each category of data will depend on the purpose for which it was collected and applicable legal requirements. When we no longer need your personal data, we will take steps to delete or anonymize it.Excerpt from Riot Games's Privacy Notice
REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary for the purposes for which the data is processed (storage …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Indefinite or open-ended retention tied to broad purposes like 'enforce our agreements' or 'resolve disputes' means data may be retained for longer than users might expect, and specific deletion timelines are not guaranteed.
Riot does not specify fixed retention periods for most data categories, meaning your personal data including gameplay records, communications content, and behavioral profiles may be retained for an extended and not clearly defined period. Submitting a deletion request through the privacy portal is the most direct way to request earlier deletion.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Riot Games.