Bing revises its data retention policy

Bing applied significant changes in its data use policy.

A paragraph specifying the retention policy for personalised advertising was removed. It was set at 13 months unless the user consented to a longer period.

Another paragraph about de-identification of “stored search query” was removed. IP addresses were supposed to be deleted after 6 months, and session identifiers after 18 months.

The introductory paragraph of the section has been updated to reintroduce retention of personal data for “other legitimate purposes, such as operating our business, meeting our contractual and legal obligations, improving and developing our products and services, protecting the safety and security of our systems and customers, and resolving disputes”.

The previous version only referred to legal obligations. This change expanded the initial scope to include improving products, business operations, and security. Criteria to determine retention periods are now summarised into three categories: purpose, nature and sensitivity, and obligations.