Deletion and Retention Transparency

[Red-Ed]

Arlo seems to claim that user privacy and protection is a serious concern, when it comes to Arlo cloud content and personal data. There are numerous links to view Arlo policies related to this area.  Some are more clear, while others are not as clear and more legal double talk.  I am looking for a little more transparency on retention periods of both personal data and recorded content.  I have read that recorded content is erased and then promptly and permanently deleted.  There is a different definition for both delete and erase in the real world.  So, is content first deleted or is it erased?  Exactly how is this done to make it permanently unrecoverable?  What is retained from this information for a retention period, and for how long?  As retention for legal requirements isn't clearly defined in policies viewed.  What is able to be viewed by Arlo employees or third party testing, prior to and after deletion of cloud content?  These are questions that should be easy to answer from Arlo when it comes to transparency and user privacy.  

[JamesC · Accepted solution]

Red-Ed,

Thank you for raising your concerns regarding content deletion and retention.

When you choose to store content in the Arlo cloud, that content is kept there for the duration of your chosen Arlo subscription plan. After that duration, the content is automatically deleted from the cloud and will no longer be accessible by you, any shared users, or Arlo. Videos that have not yet been deleted are securely stored in the Arlo cloud and as stated in Arlo’s Terms of Service “Our personnel do not view your private photographs or videos without your permission unless compelled by law.”

If you have an Arlo account, Arlo takes measures to delete your personal information, or keep it in a form that does not permit identifying you, when this information is no longer necessary for the purposes for which we process it or when you request its deletion, unless we are required or permitted by law to keep the information for a longer period.

We retain other personal information associated with your Arlo account for the period necessary or relevant for the practices described in Arlo’s Privacy Notice.

I encourage you to reference the publicly available Arlo Privacy Notice found here for more information: https://us.arlo.com/pages/privacy-notice

I hope this helps,

JamesC

[Red-Ed]

• Hi JamesC,  I appreciate the reply and provided information.  I did review much of that information prior to my post.  I understand that there has to be legal terminology in privacy policies.  However, Arlo really doesn't specify what log information may be kept, and for how long.  It also doesn't specify what personal information can be derived from this data and what they do with it or why it needs to be kept for an extended period, especially if all cloud content has been truly erased and is therefore unrecoverable?  I just think Arlo could do more to provide users with more transparency and privacy protection details. Users should have access to what information is being retained, what user information has been accessed (absent legal process) and for what reasons, to include Arlo's access.  I know that privacy violations can be a disaster for Arlo, so, it isn't like I don't believe they actually have safeguards in place.  Just the same, these things I mentioned aren't a novel idea or something that should be difficult for Arlo to explain to users.  Hopefully, Arlo can improve in this area, as I do think they do a better job in this area when compared to other companies.  They just need to better letting users know their privacy comes first!