The policy states that X may retain identifiers such as email address and phone number indefinitely following account suspension for policy violations, for the purpose of preventing creation of new accounts by suspended users.
This analysis describes what X's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes an indefinite retention period for specific user identifiers following account suspension, which deviates from time-limited retention practices and may require evaluation under GDPR's data minimization and storage limitation principles for EU users.
⚠ For users whose accounts are suspended, the terms state that email addresses and phone numbers used to create the account may be retained indefinitely as described.
Cross-platform context
See how other platforms handle Data Retention on Account Suspension and similar clauses.
Compare across platforms →"Where you violate our Rules and your account is suspended, we may keep the identifiers you used to create the account (such as your email address or phone number) indefinitely to prevent repeat policy offenders from creating new accounts.Excerpt from X's Privacy Policy
(1) REGULATORY LANDSCAPE: This provision engages GDPR's storage limitation principle, which requires personal data to be kept no longer than necessary for the stated purpose, and may require evaluation of the proportionality of indefinite retention …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes an indefinite retention period for specific user identifiers following account suspension, which deviates from time-limited retention practices and may require evaluation under GDPR's data minimization and storage limitation principles for EU users.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by X.