The policy states that personal information is retained for variable periods depending on information type and business or legal requirements, including for the duration of a subscription and potentially beyond subscription termination for fraud prevention, tax, and legal purposes, with destruction, deidentification, or anonymization applied when identifiable retention is no longer needed.
This analysis describes what Xfinity's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that personally identifying information is retained for the full duration of active subscriptions and may be retained after subscription termination for unspecified business and legal purposes, without disclosing specific retention periods for individual data categories. The absence of enumerated retention schedules may create compliance considerations under GDPR's storage limitation principle and CCPA's deletion right framework.
Interpretive note: The policy does not specify retention periods for individual data categories, making it difficult to assess compliance with jurisdiction-specific storage limitation requirements without reference to Xfinity's internal retention schedules.
Under this clause, Xfinity retains personally identifying information throughout the subscription period and potentially after termination for business and legal purposes. The agreement does not specify retention periods for individual data categories, and users may request deletion of certain personal information through the Privacy Center at xfinity.com/privacy/requests.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We keep your personal information for different lengths of time depending on the type of information and the business and legal requirements. For example, if you are a customer, we keep information that personally identifies you as long as you subscribe to one or more of our Services. If you no longer subscribe to a Service, we still may need that information for business and legal requirements, such as to protect against fraud, calculate taxes, or respond to legal requests. Other information is deleted automatically after a set period of time, often set by law, unless we are legally required to hold it longer, such as for pending litigation. We destroy, de-identify, or anonymize the information when it is no longer needed in identifiable form.Excerpt from Xfinity's Comcast Privacy Policy
1) REGULATORY LANDSCAPE: GDPR Article 5(1)(e) imposes a storage limitation principle requiring that personal data be kept in identifiable form no longer than necessary for stated purposes.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that personally identifying information is retained for the full duration of active subscriptions and may be retained after subscription termination for unspecified business and legal purposes, without disclosing specific retention periods for individual data categories. The absence of enumerated retention schedules may create compliance considerations under GDPR's storage limitation principle and CCPA's deletion right framework.
Under this clause, Xfinity retains personally identifying information throughout the subscription period and potentially after termination for business and legal purposes. The agreement does not specify retention periods for individual data categories, and users may request deletion of certain personal information through the Privacy Center at xfinity.com/privacy/requests.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Xfinity.