Retention periods disclosed for each category of PI

CPRA amended CCPA to require, at § 1798.100(a)(3), that businesses disclose retention periods for each category of personal information — or the criteria used to determine them. A privacy policy that says "we retain your information for as long as necessary" satisfies neither the letter nor the spirit of this requirement. Beyond compliance, undisclosed retention creates a data-breach surface: data that should have been deleted years ago is still in the database when a breach occurs. Disclosed retention periods only close the compliance gap if automated enforcement — cron jobs, database lifecycle rules — actually delete or anonymize the data when periods expire. Policy and code must match.

Add a Data Retention section to your privacy policy using CCPA-defined category names and specific periods, then implement automated deletion jobs that enforce those periods.

## Data Retention (privacy policy section — use CCPA category names)
| CCPA Category               | Retention Period                               |
|-----------------------------|------------------------------------------------|
| Identifiers (account data)  | Until deletion request + 30-day grace period  |
| Internet/network activity   | 26 months from collection                     |
| Commercial information      | 7 years (US tax requirements)                 |
| Geolocation data            | 90 days                                       |
| Server/access logs          | 90 days                                       |

// app/api/cron/retention-cleanup/route.ts
export async function GET() {
  const analyticsCutoff = new Date()
  analyticsCutoff.setMonth(analyticsCutoff.getMonth() - 26)
  await db.analyticsEvent.deleteMany({ where: { createdAt: { lt: analyticsCutoff } } })

  const logCutoff = new Date()
  logCutoff.setDate(logCutoff.getDate() - 90)
  await db.accessLog.deleteMany({ where: { createdAt: { lt: logCutoff } } })

  return Response.json({ ok: true })
}

Register this route in vercel.json as a cron job running daily.