Steam processes your data under four legal bases which also determine how long your data is kept, who can access it, and what rights you have to control it. The policy references a separate section 6 for full details on user rights including access, deletion, and portability.
This analysis describes what Steam's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes the principle of purpose limitation by creating a linkage between stated collection purposes and downstream data governance practices (retention, access, user rights). It establishes that the policy's subsequent sections on storage duration, access controls, and user remedies are all constrained by the documented purposes for collection.
The removal of this framework provision reduces the structured overview of how data processing policies interconnect with user rights and control mechanisms.
View full change record →Steam's data retention and your deletion rights are tied to the legal basis for each processing activity, meaning some of your personal data may be retained indefinitely for legal compliance or legitimate business purposes even after you request deletion.
How other platforms handle this
We keep some data until you delete your Google Account, such as information about how often you use Gemini Apps.
If you decide to delete your Profile, it will no longer be visible to other Grindr users and your personal information will generally be deleted within 28 days.
We collect and keep personal data only as needed or allowed for the purposes set out in this Statement, based on the reason we collected the personal data in the first instance and what is permitted under the laws that apply to the processing.
"These reasons for collecting and processing Personal Data determine and limit what Personal Data we collect and how we use it (section 3. below), how long we store it (section 4. below), who has access to it (section 5. below) and what rights and other control mechanisms are available to you as a user (section 6. below).Excerpt from Steam's Privacy Policy
REGULATORY FRAMEWORK: GDPR Arts.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision operationalizes the principle of purpose limitation by creating a linkage between stated collection purposes and downstream data governance practices (retention, access, user rights). It establishes that the policy's subsequent sections on storage duration, access controls, and user remedies are all constrained by the documented purposes for collection.
Steam's data retention and your deletion rights are tied to the legal basis for each processing activity, meaning some of your personal data may be retained indefinitely for legal compliance or legitimate business purposes even after you request deletion.
ConductAtlas has identified this type of provision across 274 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Steam.