Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy establishes a tiered data retention framework under which some data is deleted at user request, some is automatically deleted or anonymized after set periods, and some is retained until account deletion or for extended periods for legitimate business or legal purposes, with acknowledged delays between user deletion requests and removal from backup systems.
This analysis describes what YouTube Ads's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that user-initiated deletion does not result in immediate removal from all systems, and that certain categories of data are retained beyond user control for business or legal purposes. The acknowledgment of backup system delays is relevant to the operationalization of deletion rights under GDPR and U.S. state privacy laws.
The updated policy makes several material clarifications about how Google links your activity across websites and apps. It shifts from describing analytics tools in isolation to framing them as part of a broader 'ad and analytics services' ecosystem, and broadens the scope of data linking to explicitly include 'cookies and other technologies'. The policy also clarifies that data sharing occurs even in private browsing modes. Review your Google Account activity controls to understand what data is being collected and linked across services you use.
View change record →Under this clause, data users delete from their Google Account may remain in active and backup systems for an unspecified period before full removal. Certain data categories, including service usage frequency information, are retained until account deletion, and some data is retained for longer periods for security, fraud prevention, or financial record-keeping purposes.
Cross-platform context
See how other platforms handle Data Retention and Deletion Process and similar clauses.
Compare across platforms →Monitoring
YouTube Ads has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain the data we collect for different periods of time depending on what it is, how we use it, and how you configure your settings: Some data you can delete whenever you like, such as your personal info or the content you create or upload, like photos and documents. You can also delete activity information saved in your account, or choose to have it deleted automatically after a set period of time. We'll keep this data in your Google Account until you remove it or choose to have it removed. Other data is deleted or anonymized automatically after a set period of time, such as advertising data in server logs. We keep some data until you delete your Google Account, such as information about how often you use our services. And some data we retain for longer periods of time when necessary for legitimate business or legal purposes, such as security, fraud and abuse prevention, or financial record-keeping. When you delete data, we follow a deletion process to make sure that your data is safely and completely removed from our servers or retained only in anonymized form. We try to ensure that our services protect information from accidental or malicious deletion. Because of this, there may be delays between when you delete something and when copies are deleted from our active and backup systems.Excerpt from YouTube Ads's Google Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates GDPR Article 17 (right to erasure) and its conditions allowing retention for legal obligations and legitimate interests, enforced by EU data protection authorities. It also engages U.S. state privacy law deletion rights under CCPA and the enumerated state statutes, which generally permit retention for security, fraud prevention, and legal compliance purposes. The unspecified duration of backup system delays may require evaluation against GDPR's requirement for erasure without undue delay. 2. GOVERNANCE EXPOSURE: Medium. The provision's acknowledgment of backup delays and category-based retention is consistent with common industry practice but requires organizations relying on Google services for personal data processing to account for these retention timelines in their own GDPR and U.S. state privacy law compliance representations. 3. JURISDICTION FLAGS: EU/EEA users have GDPR Article 17 erasure rights, and the adequacy of Google's deletion process relative to the 'without undue delay' standard depends on the actual backup system timelines, which are not specified in the policy. California residents have CCPA deletion rights subject to similar exceptions for legal and security purposes. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations using Google Workspace or Google Cloud as data processors should ensure their data processing agreements address the backup retention timelines described in this provision and reflect these timelines in their own data retention policies and subject rights request procedures. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should document that deletion requests submitted to Google may not result in immediate removal from backup systems, and should factor this into subject rights request response timelines communicated to data subjects. Data retention schedules for Google-stored data should account for the categories of data retained beyond user-initiated deletion described in this provision.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that user-initiated deletion does not result in immediate removal from all systems, and that certain categories of data are retained beyond user control for business or legal purposes. The acknowledgment of backup system delays is relevant to the operationalization of deletion rights under GDPR and U.S. state privacy laws.
Under this clause, data users delete from their Google Account may remain in active and backup systems for an unspecified period before full removal. Certain data categories, including service usage frequency information, are retained until account deletion, and some data is retained for longer periods for security, fraud prevention, or financial record-keeping purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by YouTube Ads.