Waze keeps your personal data for as long as it needs it for the stated purposes, after which it states it will delete or anonymize the data, but the policy does not specify fixed retention periods for specific data categories.
This analysis describes what Waze's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause defines the operational scope and duration of data retention practices. It establishes legal compliance, service delivery, and dispute resolution as the institutional bases for retention decisions, and commits the entity to removal or de-identification once those purposes no longer apply.
Interpretive note: The policy does not specify retention periods for individual data categories; the practical retention duration for location and driving behavior data is therefore uncertain from the policy text alone.
The updated policy now explicitly discloses that Waze periodically collects all phone numbers stored on your device's contact book as part of the 'find friends' feature. According to the revised terms, these phone numbers are collected in a form that is initially anonymous to Waze and are used to help create a list of other Waze users you may know. The policy clarifies that names, addresses, and other contact information are not collected from your phone book, though such information may be saved locally on your device for local searches. Additionally, the updated terms now explicitly authorize connecting your Waze account to social network accounts and sharing profile information from those networks. You can control whether to use the 'find friends' feature and whether to connect social network accounts to your Waze account.
View change record →The updated policy removes explicit language describing how Waze collects phone numbers from device contact books and integrates social network accounts. Previously, the policy stated that Waze would 'periodically collect all of the phone numbers which are stored on your device's phone contacts book' and described how this information was used for the 'find friends' feature. The revised policy no longer includes these specific disclosures. This does not necessarily mean the practices have stopped, but it means the policy provides less transparency about what data Waze collects from your device and how it uses contact information. Users who relied on these detailed descriptions to understand Waze's data practices will find the updated policy less explicit on these points.
View change record →The updated privacy policy now explicitly discloses that Waze periodically collects all phone numbers stored in your device's contact book as part of the 'find friends' feature. According to the policy, this information is collected in an anonymous form to Waze and is used to identify other Waze users you may know. The terms also clarify that social network information can be shared with Waze and other users if you choose to connect your social network account. While the policy states that names, addresses, and other contact book information are not collected, some contact information may be saved locally on your device for local search purposes. You can control whether this feature operates by not using the 'find friends' feature or by not granting the app contact access through your device settings.
View change record →The policy states data is kept as long as necessary for service provision, legal compliance, and dispute resolution, but does not provide specific retention timelines for location data, driving history, or other categories; users who want their data deleted before the unspecified retention period ends should submit a deletion request.
How other platforms handle this
We store information until it is no longer necessary to provide our services and WhatsApp Products, or until your account is deleted or becomes inactive, whichever comes first. This is a case-by-case determination that depends on things like the nature of the information, why it is collected and pro...
You may request deletion of your account at any time. When you request account deletion, we will delete or anonymize your personal information unless we are required to retain it by law, or unless we need to retain it for legitimate business purposes such as resolving disputes, enforcing our agreeme...
We'll retain your Personal Data for only as long as we need in order to provide our Services to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Data will depend on a number of...
Monitoring
Waze has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We retain your personal information for as long as necessary to provide you with our services, comply with our legal obligations, resolve disputes, and enforce our agreements. When we no longer need your personal information, we will delete or anonymize it.— Excerpt from Waze's Waze Privacy Policy
1) REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data is kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which it is processed (storage limitation principle); the absence of defined retention periods for specific data categories may create compliance exposure in EU/EEA jurisdictions where regulators expect granular retention schedules. CCPA does not impose specific retention period requirements but requires accurate disclosure of retention practices. 2) GOVERNANCE EXPOSURE: Medium. The provision's open-ended retention standard is common in industry privacy policies but may not fully satisfy GDPR's storage limitation principle as interpreted by EU supervisory authorities, which have in some cases required specific retention schedules for sensitive data categories such as precise location. 3) JURISDICTION FLAGS: EU/EEA jurisdictions present heightened exposure; EDPB guidance and national DPA decisions have in practice required that controllers specify retention periods or the criteria used to determine them, particularly for sensitive data categories. UK ICO guidance similarly expects granular retention information. 4) CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with sub-processors should mirror Waze's retention obligations and require downstream deletion upon Waze's deletion of the underlying data. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should develop and document a data retention schedule specifying maximum retention periods for each material data category (location, driving behavior, communications, contact data) and ensure that automated deletion or anonymization processes are in place and technically verified. Retention schedules should be disclosed in RoPA documentation maintained under GDPR Article 30.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This clause defines the operational scope and duration of data retention practices. It establishes legal compliance, service delivery, and dispute resolution as the institutional bases for retention decisions, and commits the entity to removal or de-identification once those purposes no longer apply.
The policy states data is kept as long as necessary for service provision, legal compliance, and dispute resolution, but does not provide specific retention timelines for location data, driving history, or other categories; users who want their data deleted before the unspecified retention period ends should submit a deletion request.
ConductAtlas has identified this type of provision across 115 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Waze.