Steam processes your data under four legal bases which also determine how long your data is kept, who can access it, and what rights you have to control it. The policy references a separate section 6 for full details on user rights including access, deletion, and portability.
This analysis describes what Steam's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision operationalizes the principle of purpose limitation by creating a linkage between stated collection purposes and downstream data governance practices (retention, access, user rights). It establishes that the policy's subsequent sections on storage duration, access controls, and user remedies are all constrained by the documented purposes for collection.
The removal of this framework provision reduces the structured overview of how data processing policies interconnect with user rights and control mechanisms.
View full change record →Steam's data retention and your deletion rights are tied to the legal basis for each processing activity, meaning some of your personal data may be retained indefinitely for legal compliance or legitimate business purposes even after you request deletion.
How other platforms handle this
Managing And Deleting Your Information. You have the right to access, correct, or delete your information in certain circumstances. We store information until it is no longer necessary to provide our Services or until your account is deleted, whichever comes first. You can delete your WhatsApp accou...
Depending on where you live, you may have certain rights regarding your personal information, such as the right to request access to, update, or delete the information we hold about you. You can exercise many of these rights directly through your account settings. You can also submit a request to us...
You may request that we delete your personal information. Subject to certain exceptions, upon receiving a verifiable consumer request, we will delete your personal information from our records and direct our service providers and contractors to delete your personal information from their records.
Monitoring
Steam has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"These reasons for collecting and processing Personal Data determine and limit what Personal Data we collect and how we use it (section 3. below), how long we store it (section 4. below), who has access to it (section 5. below) and what rights and other control mechanisms are available to you as a user (section 6. below).— Excerpt from Steam's Steam Privacy Policy
REGULATORY FRAMEWORK: GDPR Arts. 15-22 establish the full suite of data subject rights: access (Art. 15), rectification (Art. 16), erasure/right to be forgotten (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), and rights related to automated decision-making (Art. 22). CCPA §§1798.100–1798.125 provide parallel rights for California residents including the right to know, delete, correct, and opt out. Valve must respond to GDPR requests within 30 days (extendable to 3 months) and CCPA requests within 45 days (extendable to 90 days).
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision operationalizes the principle of purpose limitation by creating a linkage between stated collection purposes and downstream data governance practices (retention, access, user rights). It establishes that the policy's subsequent sections on storage duration, access controls, and user remedies are all constrained by the documented purposes for collection.
Steam's data retention and your deletion rights are tied to the legal basis for each processing activity, meaning some of your personal data may be retained indefinitely for legal compliance or legitimate business purposes even after you request deletion.
ConductAtlas has identified this type of provision across 1 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Steam.