ESRB Privacy Certified C25-312.10: Written data retention policy published in the online notice (312.10)

The operator must keep children's personal information no longer than is reasonably needed for the particular purposes behind its collection, delete it when no longer needed using reasonable measures against unauthorised access or use in deletion, never retain it indefinitely, and set up, apply and keep a written policy on data retention setting out the purposes of collection, the business need for retention and a deletion timeframe, provided in the online notice under 312.4(d).