StockX keeps your personal data for as long as it needs to, which could be a very long time, without specifying exact timeframes for most data types.
This analysis describes what StockX's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Without specific retention periods defined for different data types, users cannot easily predict when their personal information, including sensitive data like government IDs, will be deleted.
Interpretive note: The complete data retention language was not fully visible in the rendered document; the provision reflects standard retention language inferred from partial text and common policy structures, with GDPR sufficiency concerns dependent on the full text of the retention section.
The updated policy authorizes StockX to share and sell personal information to a broader range of recipients than previously disclosed. Specifically, the policy now explicitly permits sharing or selling personal data, including identifiers, transaction data, and browsing behavior, to Live Sellers on the Live Shopping Platform, Sellers on the Listings Marketplace, and third-party data brokers. The prior version limited disclosures to 'sharing' with 'StockX Verified Sellers' without explicit reference to data sales or data brokers. Under the revised terms, data sale and sharing is now standard practice for analytics, advertising, and marketplace partners. The policy does not describe a consumer opt-out mechanism for this data sharing or selling.
View change record →The policy does not specify concrete retention timelines for most categories of personal data, meaning StockX may retain your purchase history, behavioral data, and identity verification records for an indefinite period tied to broadly defined business and legal needs.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.Excerpt from StockX's Privacy Policy
REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept for no longer than necessary for the purposes for which it is processed (storage limitation principle), and that specific retention periods or criteria be …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Without specific retention periods defined for different data types, users cannot easily predict when their personal information, including sensitive data like government IDs, will be deleted.
The policy does not specify concrete retention timelines for most categories of personal data, meaning StockX may retain your purchase history, behavioral data, and identity verification records for an indefinite period tied to broadly defined business and legal needs.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by StockX.