Your data can outlast your account by years

This supplement describes the frozen evidence behind the article Your data can outlast your account by years. It measures captured policy wording in an archive cohort, rather than disclosure prevalence or legal compliance.

Selecting the reports

The archive inventory froze on 12 October 2026 at 19:23:12 UTC with 40,297 unique report files. Eligibility yielded 15,561 reports covering 8,217 registrable report domains. The analysis chose the latest eligible report per domain and then the 5,000 most recent domain representatives, breaking time ties by scan identifier. Selected reports completed between 2 September and 12 October 2026.

Eligible exports had a valid completion time at or before the cutoff; completed or completed-limited status; an explicit privacy-policy surface; all 11 canonical transparency rows without conflicting aliases; at least one content excerpt; at least one content row with a source URL, retrieval timestamp and recorded controller or first-party-brand relationship; and a report projection hash. Excerpts and source details could occur on different rows at this selection stage. The counted positive evidence required them together. Internal product and reserved test, example and localhost domains were excluded. No positive result for a particular content topic was required.

The domain unit uses public-suffix-aware normalization with private suffixes enabled. It is not a verified census of companies or destination domains. Reports can share policies: grouping by each report’s primary attributed policy-source URL produced 4,842 URL groups. These are URL groups, not verified unique policy documents.

Counting the evidence

Each report contributes one availability result and ten content-topic results: 55,000 check results, of which 50,000 concern content. A result is not necessarily a positive observation. Policy availability is a cohort condition, so it is separate from the ten plotted content counts. A separate cookie-disclosure row in the product’s Policies & disclosures section is outside these 11 privacy-policy checks.

The text screen applies topic-specific rules to retained excerpts. Counted rows had a stored Observed status, a nonempty excerpt, source URL, retrieval timestamp and recorded controller or first-party-brand relationship, plus wording accepted by the topic screen. Passing the screen does not establish legal adequacy or underlying practices. Nonpassing or unresolved rows do not establish absent disclosures.

Of the 5,000 eligible reports, 1,472 contributed no screened content row. Of 17,588 source-attributed Observed rows, 6,021 did not pass the study’s text-only topic screen. The table below separates those results by topic. These are retrospective research exclusions, not a measured product false-positive rate.

Exclusions were primarily insufficient topic-specific terms (5,973 rows). Other recorded reasons were generic storage wording without retention meaning (20), low-confidence or ambiguous wording (13), code or non-policy excerpts (9), and page chrome or navigation (6). The screen assigns one recorded reason to each excluded row; an exclusion does not establish that the policy lacks the disclosure.

The product uses shared topic-rejection rules within a broader projection that also checks language, context, source binding and provenance. This study reapplied the frozen retained-report text screen to historical exports from projection versions v24, v26 and v27. That retrospective screen is not a claim that every historical Observed row or every current production path uses an identical text-only test. The study preserves the original report labels.

There is one row per topic per report, and one accepted excerpt per counted row in this cohort. Topic totals therefore count reports with screened evidence. Summing them gives 11,567 report-topic entries; the same wording can recur across reports or topics. Distinct means exact excerpt text after removing the Excerpt: prefix and trimming surrounding whitespace. Capitalization, punctuation and internal whitespace remain significant. It does not mean distinct organizations or independently written policies.

The controller/contact screen retained 540 of 920 source-attributed rows. The 380 excluded excerpts lacked the required topic-specific terms; none were rejected as navigation. Counts for contact, DPO and complaints use different rules and starting rows and are not nested measures of policy completeness. DPO requirements depend on applicability, which this study did not adjudicate.

The ten screened content counts appear in the article chart. Privacy availability records 5,000 as a selection condition.

Retention coding and its limits

The 728 retention rows contain 728 passage occurrences and 676 exact unique texts. English-language rules identify number words or digits with days, months or years in retention-related sentences, with heading-bound schedule review, then classify numeric periods, criteria without an extracted numeric period, indefinite wording, or unresolved wording. Review-cadence intervals are excluded, and permanent deletion does not mean indefinite retention. Duplicate passages across reports remain in the occurrence counts. A separate search of all 728 excerpts found no retention periods expressed in weeks, hours, minutes or seconds; the only time-unit-like matches were two postal-address references to “Second Floor.”

The 70 numeric occurrences contain 67 exact unique texts. Numeric periods can describe storage, deletion, anonymization or archiving rather than a complete policy-wide retention limit. Two indefinite passages concern anonymized information. The 611 criteria-only occurrences are 83.93% of the 728 occurrences; that percentage describes passages, not websites generally.

Seven corrections bound to the retained excerpt hashes reconciled category edge cases. A separate correction restored an omitted nine-month period in wording specifying nine and eighteen months respectively. That correction left the category counts, extrema and leading frequencies unchanged. The private ledger retains the original output, correction and rationale; historical production findings were not changed.

After 200 development-sample passages and separate review of numeric candidates, the frozen rules were checked against a further random sample of 50 from 413 eligible occurrences, excluding previously inspected exact text. Validation completed on 12 October 2026. Seed 20261016 is an arbitrary reproducibility integer, not a date. The sample contained 46 criteria-only, two indefinite and two unresolved passages, with zero category or numeric-period disagreements. It contained no numeric-period passages, so it does not measure numeric-extraction accuracy on unseen positives or general accuracy across the corpus. The nine-month correction and the 16 October heading-bound schedule correction are separate from that frozen-rule check. All 70 numeric passages were rechecked against their retained excerpts for this update; this is an editorial extraction review, not independent human validation or a check of original policy pages.

Value frequencies count each value/unit once per passage. Ranges use the upper endpoint. Day equivalents order endpoints only; units otherwise remain as written. Scope and starting events are left unknown when the retained fragment does not provide them. A passage without an extracted period does not establish that the full policy lacks one.

What the study can support

The cohort is a recency-selected, non-probability snapshot. It is not representative of the web, and repeated policies and multiple topics are not independent observations. No trend, compliance ranking, confidence interval or population estimate is inferred. Non-English text is likely under-counted across topics; retention coding covers English wording only. The checks are not an exhaustive statement of US or EU law.

The analysis preserved historical report labels and reused exports from projection versions v24, v26 and v27. It did not recrawl websites or establish that the wording remains current. Selected export bytes were checked against the archive’s recorded checksums before extraction. Export checksums bind report bytes; they do not authenticate original policy-document bytes.

The four featured examples were selected to illustrate retention, rights, transfers and purposes, rather than as a random sample or endorsements. Their exact quotations, punctuation and capitalization match the retained excerpts. Their recorded policy-retrieval times are on 12 October 2026 UTC. Names are omitted; searchable quotations may still identify their sources. The source mapping and row-level evidence remain private.

CertScore.ai conducted this research using its own product data and has a commercial interest in the product. The regulatory sources provide context rather than findings about the sampled websites. Researchers and journalists can email [email protected] with “Privacy Policy Transparency Study” to request aggregate tables or ask about the methodology.