Every purchase leaves a trail. The retailer stores your name, address, phone number and email. The payment processor holds your card details. Analytics tools record what you browsed and what you almost bought. Advertising partners may receive hashed versions of your email. Weeks later, the delivery company, the marketing list and the data broker all know you bought a particular product at a particular time. Online shopping is convenient, but it is also one of the largest sources of consumer data. This guide explains what retailers keep, how long they keep it, what the law says and how to shop without handing over more than you need to.
1. What retailers collect when you shop
| Data | Why it is collected | Typical risk |
|---|---|---|
| Name, address, phone, email | Delivery, receipts, marketing | Appears in breaches and broker profiles |
| Payment details | Processing and fraud checks | Fraud if stolen |
| Order history | Returns, support, recommendations | Reveals health, family and lifestyle |
| Browsing and cart activity | Personalization and ads | Used for profiling |
| Device and location data | Fraud detection, analytics | Tracking across sites |
| Account credentials | Login | Takeover if reused elsewhere |
Order history deserves a second look. What you buy reveals more than most people think: health conditions, pregnancy, religion, finances. Marketing profiles often turn those purchases into inferred traits. See what our private data is being used for for how that plays out.
2. How long do retailers keep it
There is no single federal law that sets a general retention period for consumer data held by retailers. Retention is shaped by several separate forces.
- Tax and accounting rules push businesses to keep transaction records for several years.
- Returns, warranties and disputes justify keeping order details for the length of the relevant period.
- Fraud prevention is a common reason to keep device and transaction data.
- Marketing is the reason to keep profiles, and it is the one you can influence most, since you can opt out.
- Payment industry rules set limits on sensitive card data. Security codes may not be stored after authorization, and stored card numbers must be protected.
- State privacy laws increasingly require businesses to disclose retention periods and avoid keeping personal information longer than reasonably necessary.
The practical result is that a retailer may legitimately keep a record of what you bought for years, but it does not need to keep your marketing profile, saved card and browsing history indefinitely. Where you have rights, use them.
3. What state privacy laws give you
A growing number of states have comprehensive consumer privacy laws. Details differ, but they commonly give residents some or all of the following rights.
- Right to know what personal information a business collected and why.
- Right to delete personal information, with exceptions for legal and operational needs.
- Right to correct inaccurate information.
- Right to opt out of the sale or sharing of personal information and of targeted advertising.
- Right to limit use of sensitive personal information in some states.
California’s law is the best known; the state’s privacy agency explains consumer rights at cppa.ca.gov. Retailers in covered states generally provide a privacy request page or a link at the bottom of the site. Some states require businesses to honor browser-based opt-out signals such as Global Privacy Control, so enabling that setting can send an opt-out automatically.
These laws do not stop all collection. They give you a lever to reduce it, and the lever works best when you use it deliberately. For more on how opting out helps, read the benefits of opting out.
Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.
4. Step-by-step: shop with less exposure
Step 1: Prefer guest checkout
If you do not shop at a site regularly, check out as a guest. You avoid creating a persistent profile with saved addresses and payment methods. The order still exists, but the rest of the profile does not.
Step 2: Use a virtual card or a payment wallet
Virtual card numbers and tokenized wallets keep your real card number away from the merchant. If a retailer is breached, only a limited-use number is exposed. See mobile payments and digital theft.
Step 3: Use an alias email and a secondary phone number
Give the store an alias address that you can block if the store sells or leaks it. A secondary number prevents shipping notices and marketing from reaching your main line. See how to set up an alias email address.
Step 4: Provide only required fields
Skip optional birthday, income and survey fields. Those answers are the raw material for marketing profiles and broker records.
Step 5: Review the privacy policy for retention and sharing
Look for how long data is kept, whether it is shared with partners and how to opt out. Retailers in states with privacy laws are required to publish this.
Step 6: Send a deletion or opt-out request
After a one-time purchase, use the retailer’s privacy page to ask for deletion and opt out of sale or sharing. Keep the confirmation. Expect the retailer to keep transaction records it needs for legal reasons.
Step 7: Delete accounts you do not use
Unused accounts keep data and invite credential-stuffing attacks. Delete them and unsubscribe from marketing.
5. Protect yourself from fraud at checkout
Shopping scams are a major source of losses. The Federal Trade Commission received about 3 million fraud reports in 2025, with reported losses of $15.9 billion (FTC). Online shopping scams, fake storefronts and fake order-tracking messages are among the common types. A few habits help.
- Check the web address and look for misspellings before entering card details.
- Be wary of prices that seem too good to be true and sites with no clear contact details.
- Do not click links in unexpected shipping messages. Go to the retailer directly or see how to report spam text messages.
- Use a credit card rather than a debit card where possible, since card disputes are generally easier.
- Review statements regularly and report fraud at ReportFraud.ftc.gov.
For stores you use constantly, consider the privacy trade-offs of the biggest platforms. See does Amazon track and save our data.
6. If a retailer is breached
When a store loses customer data, act promptly.
- Change the password on the account and any other site where you used it.
- Check your card statements and replace the card if payment data was involved.
- Place a credit freeze if names, addresses and other sensitive identifiers were exposed. See what is a credit freeze.
- Watch for phishing messages that mention the retailer.
- Follow the steps in data breach response strategies.
7. Loyalty programs and the real price of discounts
Loyalty cards and app-only coupons look like free money, but they are often the largest source of purchase-history data a retailer collects. In exchange for a few dollars off, you accept linked tracking of everything you buy, sometimes across stores and partners. Ask yourself whether the discount is worth a permanent record of your purchases tied to your name and phone number.
If you still want the savings, join with an alias email and a secondary number, decline marketing partners, and check whether the program lets you view and delete your history. For sensitive categories such as health, family and finances, shop without the card. The convenience is real, but so is the profile it builds.
8. Three scenarios and what to do
Scenario 1: You bought something sensitive and want no profile. Use guest checkout with a virtual card and an alias email, ship to a secure address and avoid loyalty programs. Afterward, send a deletion request.
Scenario 2: You live in a state with a privacy law and are tired of marketing. Submit a request to delete and opt out of sale or sharing, enable Global Privacy Control in your browser and unsubscribe from lists.
Scenario 3: Your address is leaking to spam senders and people-search sites. Order history and sign-ups feed brokers. Remove your listings from people-search sites and switch to a mailing address you control.
9. What to expect: a realistic timeline
| Action | Typical time |
|---|---|
| Guest checkout and virtual card | Same purchase |
| Alias email setup | 10 minutes |
| Deletion or opt-out request | Retailer response within weeks, often 45 days |
| Broker profile removals | Days to four weeks per site |
| Reduced marketing | Weeks |
10. Common mistakes
- Saving cards on every site.
- Using the same password across retailers.
- Giving optional data for a small discount.
- Assuming that deleting an app deletes the account.
- Clicking tracking links in shipping scam texts.
- Skipping the privacy page because it looks long.
11. How Wiperts fits
Retailer requests protect you at the store. The people-search and broker profiles that result from your purchases and public records are another matter. Wiperts scans more than 100 data brokers and people-search sites for your personal information, submits removal requests, removes your personal results from Google and Bing, blurs your home on maps and monitors around the clock.
See what brokers know about you with the free diagnosis.
100% Free Diagnosis: Check Your Exposure
Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:
- First Name
- Last Name
- Select State
- Email Address
- Website
Scan Databases Now — no payment is needed to see your exposure report.
12. Key takeaways
- Retailers keep order records for legal reasons but need not keep marketing profiles forever.
- State privacy laws let many residents request deletion and opt out of sale.
- Use guest checkout, virtual cards, aliases and minimal details.
- Remove broker profiles that purchases and sign-ups feed.
Pick the Wiperts plan that fits your household
| Plan | Covers | One-time deep scrub | Then |
|---|---|---|---|
| Individual | 1 person | $89 | $14/month |
| Couples (most popular) | 2 people | $149 | $24/month |
| Family | Up to 4 people | $199 | $39/month |
Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal
13. Frequently Asked Questions
How long do online retailers keep my personal data?
It varies. There is no single federal retention period. Retailers keep order records for tax, return and fraud reasons, and marketing profiles for as long as their policies allow. Check the privacy policy, and in states with privacy laws ask for deletion.
Can I ask a retailer to delete my data?
In states with comprehensive privacy laws, such as California, you can generally request deletion of personal information the business collected, subject to exceptions like legal and tax recordkeeping. Send the request through the company’s privacy page or email.
Do stores keep my credit card number?
Only if you let them. Payment industry rules prohibit storing the card security code after authorization, but saved cards can be kept in encrypted form. Declining to save your card or using virtual numbers reduces exposure.
Is guest checkout safer than creating an account?
Often yes. A guest order still records the transaction, but you avoid creating a long-lived profile with saved addresses, cards and browsing history, and you reduce what a breach could reveal about you.
What should I do if a retailer is breached?
Change the password, watch statements, consider a credit freeze if sensitive data was exposed, and be alert for phishing that mentions the retailer. Report fraud at IdentityTheft.gov or ReportFraud.ftc.gov if needed.
Can retailers sell my shopping data?
Many share or sell data to marketing partners unless you opt out. Some state laws give you the right to opt out of sale and sharing, and browser signals such as Global Privacy Control are honored by businesses in some states.
Sources
Related Reading
- Does Amazon Track and Save Your Data? What to Know and Control
- Mobile Payments and Digital Theft: How to Stay Safe
- Selling Online With a Phone App? How to Avoid Scams and Data Theft
- How to Set Up an Alias Email Address for Social Media and Sign-Ups
- What Is a Credit Freeze? How to Place, Lift and Use It in 2026
- Data Breach Response Planner: What to Do in the First 30 Days
- Why You Should Opt Out Instead of Opting In
- What Is Our Private Data Being Used For?
Ready to erase your footprint?
Stop letting data brokers profit from your personal life. Start your removal today.
Start Removing