A. The company discloses that it does not retain user information.
B. If not, does the company satisfy any of the following elements?
1. The company discloses that it retains user information (not actively submitted by the user for the purpose of storage or publication) in an anonymized form.
2. The company discloses the types of user information it retains.
3. The company discloses how long it retains user information.
4. The company discloses that it deletes all user information after users terminate their account.
Guidance: We expect companies to disclose information pertaining to data retention. When considering user information, companies should be specific about the purpose for which they collect data, use it only for that purpose, and safely discard the data when it’s no longer needed for that purpose.
Evaluation: If a company’s disclosure states that it does not retain any user information, fulfilling element A, the company receives full credit for the indicator. If a company does not fulfill element A, the researcher will look for company disclosure to meet the checklist elements of B. A company can only receive partial credit if its disclosure meets all elements in the B checklist.
In some cases, laws or regulations might require companies to retain certain information for a given period of time. Researchers will document situations where this is the case, but a company will still lose points if it fails to meet all elements. This represents a situation where the law causes companies to be uncompetitive, and we encourage companies to advocate for laws that enable them to fully respect users’ rights to freedom of expression and privacy.
For more information, click here for a glossary of terms.
