Earlier this month, Google Analytics users received an email telling them that, as a result of the new European General Data Protection Regulation, which comes into effect at the end of May, they will no longer be retaining Analytics data indefinitely.
Instead, they have made it possible for users to set their own data retention policy in Analytics, in order to determine how long data is retained in the system.
As such, Google is avoiding shouldering the responsibility for the data, and putting that onus on the Analytics user (or website owner) instead.
Setting Your Data Retention Policy In Analytics
The data retention policy can be set under the admin property controls, and gives the option of retaining data for 14, 26, 38 and 50 months, or not allowing the data to expire.