Google keeps different types of data for different lengths of time depending on the data type and how it is used; some data is retained for extended periods even if you have not recently used it.
This analysis describes what YouTube Ads's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Data retention periods affect how long your behavioral profile persists in Google's systems, which matters both for privacy and for how long historical data can inform ad targeting or be subject to legal process.
Interpretive note: The policy does not specify maximum retention periods for most data categories, making it difficult to assess GDPR storage limitation compliance without reference to Google's supplementary retention documentation.
The updated policy makes several material clarifications about how Google links your activity across websites and apps. It shifts from describing analytics tools in isolation to framing them as part …
Certain categories of data may be retained by Google for extended periods even after users stop using a service or delete specific activity records; users cannot always control retention periods for all data types.
How other platforms handle this
We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements, to resolve disputes, and to enforce our agreements. The criteria used to determine our retention periods include: the length of ...
We may retain de-identified or aggregated information that can no longer be used to identify you for any period of time, including indefinitely.
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, or as otherwise permitted or required by applicable law.
Monitoring
YouTube Ads has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We retain the data we collect for different periods of time depending on what it is, how we use it, and how you configure your settings. Some data you can delete whenever you like, some data is deleted automatically, and some data we retain for longer periods of time when necessary.— Excerpt from YouTube Ads's Google Privacy Policy
REGULATORY LANDSCAPE: Data retention engages GDPR Article 5(1)(e) (storage limitation principle), which requires that personal data be kept no longer than necessary for its stated purpose. CCPA/CPRA does not prescribe specific retention periods but requires disclosure of retention practices. The FTC Act applies to representations about data retention that may be deceptive. Relevant authorities include EU DPAs, the UK ICO, and the FTC. GOVERNANCE EXPOSURE: Medium. The policy's statement that some data is retained 'for longer periods of time when necessary' without specifying the criteria or maximum retention periods may create tension with GDPR's storage limitation principle. Regulatory guidance from EU DPAs has increasingly emphasized the need for specific, documented retention schedules rather than open-ended necessity assessments. JURISDICTION FLAGS: EU and UK users have the strongest regulatory protection under GDPR's storage limitation principle. California users have disclosure rights regarding retention periods under CPRA. Organizations subject to sector-specific retention requirements (financial services, healthcare) should assess whether Google's retention practices for data processed on their behalf align with those requirements. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Google Ads products should confirm in their data processing agreements the specific retention periods applicable to data they have provided to Google, including Customer Match lists and conversion tracking data. Indefinite or open-ended retention assertions by a processor may create compliance exposure for the controller. COMPLIANCE CONSIDERATIONS: Compliance teams should obtain and document Google's specific data retention schedules for each data category relevant to their use case as part of vendor due diligence. Where Google acts as a data processor, the controller's data processing agreement should specify maximum retention periods aligned with the controller's own regulatory obligations.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Data retention periods affect how long your behavioral profile persists in Google's systems, which matters both for privacy and for how long historical data can inform ad targeting or be subject to legal process.
Certain categories of data may be retained by Google for extended periods even after users stop using a service or delete specific activity records; users cannot always control retention periods for all data types.
ConductAtlas has identified this type of provision across 15 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by YouTube Ads.