It depends. Some countries have laws creating data retention requirements — in some contexts, for some time periods (with mandatory expiration in the EU), with

It depends. Some countries have laws creating data retention requirements — in some contexts, for some time periods (with mandatory expiration in the EU), with sharing conditional on some purposes (hopefully for reasons relating to serious crime, but with some laws suspecting or detecting copyright infringement is good enough), with varying degrees of judicial review and oversight of bad-faith requests. https://en.wikipedia.org/wiki/Telecommunications_data_retention https://en.wikipedia.org/wiki/Telecommunications_data_retent... (concerns telcos, e-mail hosts, and web-hosts) The USA doesn't have a law like that, but it doesn't have a right to privacy either (there is a law about the privacy of correspondence that the NSA and telcos have ignored), so this sort of data retention law is sidestepped by a few large actors “voluntarily” collecting and sharing information. National security letters, gag orders, and whatever power incited AT&T to first do large scale warrantless interception mean that there can be a lot of abuse with little consequences for the participants. This might also apply to smaller actors, although less publicised (I don't know if there's any bad publicity the US government would care about). If you collect it, you might end up sharing it.