Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that personal information is retained for as long as necessary to fulfill collection purposes and meet legal obligations, without specifying fixed retention periods for most data categories.
This analysis describes what Whatnot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The absence of defined retention timelines for most data categories may require evaluation under GDPR Article 5(1)(e), which establishes a storage limitation principle requiring that personal data be kept no longer than necessary for specified purposes with defined periods where practicable.
Interpretive note: The adequacy of the policy's retention disclosure may depend on the specific CPRA regulatory guidance applied and whether EU supervisory authorities treat the general language as satisfying GDPR Article 5(1)(e) documentation requirements.
The updated Influencer Engagement Agreement now requires all disputes between influencers and Whatnot to be resolved through binding arbitration under the Terms of Service Section 21, rather than through California state or federal courts. This replaces the previous language permitting influencers to pursue legal claims in Los Angeles courts and waives jury trial rights. The agreement also removes language that explicitly limited dispute resolution to claims arising solely from the Influencer Agreement, extending arbitration to disputes relating to Whatnot Platform use and the influencer-platform relationship.
View change record →The new Australian Creator Program Terms establish binding legal requirements for creators submitting video content and promotional codes. Creators grant Whatnot a non-exclusive, worldwide, irrevocable license to use submitted videos across platforms (organic and paid social media, television, in-app, websites, and more) for one year from submission. The terms require creators to comply with Australian Consumer Law, AANA ethical standards, and AiMCO guidelines, with explicit disclosure requirements when promoting Whatnot or affiliated products. Rewards for approved Shopping Hauls submissions are issued within 30 business days of receiving both ad codes and raw video. You can review the specific disclosure and content standards on the Program Page before submitting content.
View change record →Under the updated agreement, Australian sellers can no longer resolve disputes through court proceedings in Los Angeles. Instead, all disputes related to the Whatnot platform or the seller relationship must be resolved through mandatory individual arbitration under Whatnot's main Terms of Service. The updated terms eliminate the jury trial waiver provision and replace court access with binding arbitration, with limited exceptions only as expressly permitted in the main Terms of Service.
View change record →Under this provision, personal information collected by Whatnot may be retained indefinitely based on business need determinations, without a specified maximum period for most categories. Users in the EU and UK may request deletion of their data subject to the exceptions stated in the policy, including legal claims and fraud prevention purposes.
Cross-platform context
See how other platforms handle Data Retention Without Fixed Timelines and similar clauses.
Compare across platforms →Monitoring
Whatnot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.Excerpt from Whatnot's Legal Terms
1. REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept in a form permitting identification no longer than necessary for the specified purpose, with the controller responsible for demonstrating compliance (Article 5(2)). The policy's open-ended retention language may require evaluation against this principle. CCPA/CPRA does not prescribe specific retention periods but requires that the privacy policy disclose the period for which each category of personal information is retained, or the criteria used to determine that period; this disclosure obligation may not be fully satisfied by the policy's general language. 2. GOVERNANCE EXPOSURE: Medium. The absence of category-specific retention periods creates GDPR documentation risk and potential CPRA disclosure obligation risk. Regulatory guidance from EU supervisory authorities has generally required more specific retention schedules or clearly defined criteria per data category. 3. JURISDICTION FLAGS: EU and UK (GDPR storage limitation and accountability obligations), California (CPRA retention disclosure requirements), and Quebec (Law 25 requires disclosure of retention policies). Australian Privacy Principle 11 also requires reasonable steps to destroy or de-identify personal information no longer needed. 4. CONTRACT AND VENDOR IMPLICATIONS: Vendor contracts with data processors should align with the controller's retention policies and require processors to delete or return data upon contract termination. If retention periods in vendor agreements exceed those described in the policy, this creates a governance gap that compliance teams should address. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should develop and document category-specific retention schedules to satisfy GDPR Article 5(1)(e) and CPRA disclosure obligations. A retention schedule should be reflected in the privacy policy or in a supplemental disclosure accessible to users. Automated deletion workflows should be audited to confirm alignment with documented retention policies.
The absence of defined retention timelines for most data categories may require evaluation under GDPR Article 5(1)(e), which establishes a storage limitation principle requiring that personal data be kept no longer than necessary for specified purposes with defined periods where practicable.
Under this provision, personal information collected by Whatnot may be retained indefinitely based on business need determinations, without a specified maximum period for most categories. Users in the EU and UK may request deletion of their data subject to the exceptions stated in the policy, including legal claims and fraud prevention purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Whatnot.