Data retention has been subject of extensive and fierce discussions amongst practitioners, policy makers, civil society and academia in the EU and its Member States for many years – often coined as a clash between liberty and security. Through its jurisprudence, the Court of Justice of the EU (‘CJEU’) attempts to find a balance between the fundamental rights and freedoms at stake. This article provides a legal analysis of the jurisprudence of the CJEU on data retention, from the Decision in Digital Rights Ireland/Seitlinger to the most recent Decisions in the Cases Privacy Int., Quadrature du Net and H.K. v. Prokuratuur. It observes that while the CJEU has reconfirmed its previous jurisprudence on data retention, it widely opens the door to a variety of exceptions.