How long do companies keep my information?

Forever. In more places than you can name.

That’s the real answer, and everything below is just the mechanism.

The Sentence That Never Terminates

Nearly every privacy policy says some version of this:

We retain your information for as long as necessary to fulfill the purposes described in this policy.

Read it twice. It’s a loop.

If one of the stated purposes is marketing, then retaining your data is necessary for as long as they’d like to market to you—which is forever, because there’s no condition under which marketing to you stops being a purpose.

That’s not a retention policy. It’s a retention policy-shaped object.

The Copy Problem

Here’s what breaks even good intentions: a company that genuinely honors deletion can only delete its own copy.

Once your record has been sold or shared, every recipient holds an independent copy under its own retention terms. The appenders and enrichment services that touched it along the way hold derivatives. And there is no upstream signal, no protocol, no mechanism that propagates your deletion across the chain. None. It was never built, because nobody buying data ever asked for it.

Delete from company A and companies B through Z still have you. Worse: B can re-supply A six months later, which is exactly why records you thought you’d killed reappear.

Data deletion isn’t a switch. It’s a campaign, fought company by company, against an opponent that reproduces.

What Deleting Your Account Actually Does

It removes your ability to log in. It removes your visible profile.

It frequently does not remove records already exported into marketing systems and CRMs, backups (routinely excluded from deletion timelines), data already sold to partners, or transaction records retained for tax, fraud, and legal reasons—a legitimate exception that gets stretched generously.

“Delete my account” and “delete my data” are different requests. Only one of them has a button.

What You’re Actually Owed

Depending on where you live, you may have real rights: to know what’s held, to demand deletion, to opt out of sale or sharing, with defined windows for compliance.

Four states now require data brokers to register: California (with the California Privacy Protection Agency), Texas (Secretary of State), Oregon (Department of Consumer and Business Services), and Vermont (Secretary of State). California’s annual fee runs $6,000; Texas charges nothing; Oregon settled at $600. Those registries are public, which means you can look up who’s legally admitted to being in this business.

These rights matter. But they’re request-driven. Nothing happens until you ask, per company, in writing. And enforcement generally depends on somebody noticing non-compliance and caring enough to report it.

A right you have to personally litigate isn’t much of a right. It’s a hobby.

Rules and deadlines vary by state and change often, so check your state attorney general’s current guidance rather than trusting any article—including this one.

The Strategy That Works

Go after the sources first; killing the record at the original collector stops new copies from being generated downstream. Put every request in writing with a deadline, because a verbal ask to a call center agent is unverifiable and effectively imaginary. Keep evidence of what you asked and when, because a documented pattern of ignored requests is what makes non-compliance actionable. And expect to repeat it, because records come back.

If doing that by hand for forty companies sounds like a second job, that’s because it is. PRYVC automates the whole loop: finds each company’s privacy contact, sends the formal deletion and cease-contact request, tracks the deadline, and generates a court-ready affidavit when somebody blows through it.