What you type is a fraction of the profile: off-platform activity reports back and inferred attributes fill in the rest, held with no fixed end. Deleting the profile is account closure under another name, and a suspended account's identifiers can stay indefinitely.
A rich behavioural and social profile; keeping the record matters.
Posts and "derived" profile data are commonly kept with no end date; deletion often means hidden, not gone.
Sign-up asks for little, but age-assurance and appeals increasingly demand a face scan or ID.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
What leaks is your private messages, your photo library and your contact graph. None of that can be changed afterwards, and it exposes the people around you as much as it exposes you.
You post less than they hold
What you type into the app is a fraction of your profile. Advertisers and the platform's own tag on other sites report back what you did away from it, and the platform then infers what you never told it: your age, your gender, your interests, sometimes a pay bracket, and, where you are signed out, an identity pinned to you all the same. None of it came from a box you filled in.
Shared by type, never by name
Policies name who receives your data by category, advertising, analytics and measurement partners, not one by one. Several concede in the same breath that these partners collect their own identifiers from you, a cookie ID or a device identifier, and may use what they receive for their own ends. In the UK and EU the law lets you get the names behind a category; in the US it stops at the categories.
Open-ended by default
The default has no fixed end. Many policies say they hold your data as long as you keep the account, or as long as they judge it necessary. Where numbers do appear they are the company's own claim, and they run from about thirty days to two years and beyond, often only in the UK and EU version of the policy.
Deleting the profile and leaving are the same act
The profile is not a record kept beside the service, it is what the service runs on, so a deletion aimed at it is account closure under another name. The request that changes anything while you stay is a limit: stop the profiling, the targeting and the training, and leave the account standing. It is also the hardest of them to refuse, because a European regulator weighed all three grounds a platform gave for ad profiling and rejected every one.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Who you message and follow maps your whole network.
What you engage with is used to infer your leanings.
Follows and reactions imply faith and community.
Engagement patterns have been shown to reveal orientation.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
To enforce bans and stop blocked or abusive users coming back.
A legal duty to preserve child-safety reports, which overrides an erasure request for that data.
They treat it as no longer being about you, though such data can sometimes be re-identified.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
A number you give only for account security is not ring-fenced. US regulators penalised one platform after phone numbers and email addresses collected to secure accounts were used to target ads, affecting more than 140 million people. On some platforms your public posts now feed the company's own AI, and on at least one they flow to outside firms to train theirs unless you opt out.
Attention and inferred interests are the entire business model.
Your posts, images, and messages train the platform's own models; opt-outs work only going forward.
Anonymised is their word. Your writing style is a fingerprint: language models infer who is behind pseudonymous posts at scale (Staab et al., ICLR 2024), and network structure alone re-identifies accounts (Narayanan and Shmatikov, 2009).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four time-and-place points single out 95% of people in mobility data (de Montjoye et al., Scientific Reports, 2013).
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
The shape of who a person connects with re-identifies accounts across networks with no other data (Narayanan and Shmatikov, 2009).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the Crowd: The privacy bounds of human mobility (Scientific Reports 3, 1376, 2013)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)·De-anonymizing Social Networks (IEEE Symposium on Security and Privacy, 2009)
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“actions you have taken outside of our websites and apps”
Your ad profile grows from what you did on unrelated sites and apps, fed back by advertisers or picked up by the platform's own tag. It reaches well past anything you posted to the account.
THE MOVE A See request covers this off-site layer, not just your posts. What they pulled in, and from where, is theirs to lay out, and the reply goes on your record.
“we infer your attributes and interests based on the information we have about you”
New data gets made about you that you never gave: age, gender, interests, and on some apps an identity while you are signed out. A request worded around the data you provided misses this layer, because you never provided it.
THE MOVE A See request reaches the data they made, not only the data you gave. What they infer is theirs to state, and the reply goes on your record.
“indefinitely to prevent repeat policy offenders from creating new accounts”
The email or phone number you signed up with can be kept past every window they otherwise state, with no end, once the account is tied to a rule violation. You cannot see the trigger or the keeping.
THE MOVE A Delete request meets this carve-out where it applies. What they will hold, and for how long, is theirs to answer, and the reply, or the silence, goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →