Yes.

Most privacy laws in the United States do not require that a company publicly disclose the length of time that personal information will be kept. While the CCPA did not contain such a requirement, the CPRA will require, beginning on January 1, 2023, that businesses inform consumers at the point at which information is collected of the “length of time the business intends to retain each category of personal information” that it collects.[1] If it is not possible for a business to provide consumers with a specific retention period, the business is instructed to disclose “the criteria used to determine such period. . . .”[2]

1] CPRA, 1798.100(a)(3).

[2] CPRA, 1798.100(a)(3).