At least in the EU it is required that data is only stored as long as it is needed and the user actively consents to it. An active consent can expire if the user isn’t engaged for a long time (how long depends on the type of data and service).

The user in the article is from the US though. I don’t know about the rules there.