Steam keeps your personal data only as long as needed for the stated purpose or to meet legal requirements, using a proportionality assessment to set retention periods.
This analysis describes what Steam's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy does not specify fixed retention periods for most data categories, meaning your data may be retained for extended periods based on Valve's internal assessments of operational and legal necessity.
Interpretive note: The policy provides retention criteria rather than specific retention periods, meaning the actual duration of data storage for key categories such as payment data and game statistics cannot be determined from the policy text alone.
This addition provides specific data retention guidelines and criteria, demonstrating commitment to data minimization and compliance with retention limits mandated by privacy regulations.
View full change record →Valve applies a factors-based retention assessment rather than fixed retention periods for most personal data categories, which means the duration your game statistics, account data, and payment information are held is determined by Valve's internal policies that are not publicly disclosed in this document.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We will only store your information as long as necessary to fulfil the purpose it was collected for, including for the purposes of satisfying any legal, accounting or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.Excerpt from Steam's Privacy Policy
(1) REGULATORY LANDSCAPE: GDPR Article 5(1)(e) establishes the storage limitation principle, requiring that personal data be kept no longer than necessary for the specified purpose.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy does not specify fixed retention periods for most data categories, meaning your data may be retained for extended periods based on Valve's internal assessments of operational and legal necessity.
Valve applies a factors-based retention assessment rather than fixed retention periods for most personal data categories, which means the duration your game statistics, account data, and payment information are held is determined by Valve's internal policies that are not publicly disclosed in this document.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Steam.