Signal
Answered a grand jury subpoena with timestamps and nothing else
The messenger holds no messages, call logs, contacts or group memberships, so a US grand jury request produced almost nothing to hand over.
All case studies
Facebook
Data Retention
8 case studies tagged data retention.
Capital One
Over-broad credentials turned an SSRF flaw into 106 million records
A firewall misconfiguration exposed the metadata service, and the IAM role it handed back could read the customer-data buckets.
DoorDash
Stored four digits of a bank account, so the breach was not a payments breach
The 2019 breach reached names and driving licence numbers, but the account field had been truncated years earlier, which limited what could be done with it.
CNIL / KASPR
Ordered deletion of a LinkedIn contact database
France's data authority fined a contact-data broker €240,000, then closed the order when the company removed its LinkedIn database instead of cleaning it.
FTC / Illuminate Education
Ordered deletion of student data it did not need
A consent order made deletion a compliance term: the company must remove covered information it does not need and keep a retention schedule it can be held to.
India, DPDP Rules
Put a three-year ceiling on retention
The 2025 rules require large platforms to erase personal data after three years of inactivity, while setting a minimum one-year hold for traffic data and logs.
California Privacy Protection Agency
Made brokers delete on a 45-day clock
Over 600 registered brokers must action pending deletion requests every 45 days or pay $200 a day per request, through a platform that stores no raw identifiers.
Logged hundreds of millions of passwords in plaintext
Internal logging captured authentication payloads for debugging and kept the passwords readable, which is verbose observability turning into an incident.